Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 13 Nov 2013 18:34:38 +0100
From: Petr Matousek <pmatouse@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Kurt Seifried <kseifrie@...hat.com>, Saran.Neti@...us.com
Subject: CVE-2013-4563 -- Linux kernel: net: large udp packet over IPv6 over
 UFO-enabled device with TBF qdisc panic

Commit 1e2bd517c108816220f262d7954b697af03b5f9c ("udp6: Fix udp
fragmentation for tunnel traffic.") changed the calculation if
there is enough space to include a fragment header in the skb from a
skb->mac_header dervived one to skb_headroom. Because we already peeled
off the skb to transport_header this is wrong.

This fixes a panic Saran Neti reported. He used the tbf scheduler which
skb_gso_segments the skb. The offsets get negative and we panic in
memcpy because the skb was erroneously not expanded at the head.

Introduced by:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1e2bd517c108816220f262d7954b697af03b5f9c

Introduced in:
v3.10-rc5

Upstream fix:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0e033e0

References:
http://marc.info/?l=linux-netdev&m=138305762205012&w=2
https://bugzilla.redhat.com/show_bug.cgi?id=1030015

Acknowledgements:

Red Hat would like to thank Saran Neti of TELUS Security Labs for
reporting this issue.

Thanks,
-- 
Petr Matousek / Red Hat Security Response Team

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ