Date: Wed, 13 Nov 2013 18:34:38 +0100 From: Petr Matousek <pmatouse@...hat.com> To: oss-security@...ts.openwall.com Cc: Kurt Seifried <kseifrie@...hat.com>, Saran.Neti@...us.com Subject: CVE-2013-4563 -- Linux kernel: net: large udp packet over IPv6 over UFO-enabled device with TBF qdisc panic Commit 1e2bd517c108816220f262d7954b697af03b5f9c ("udp6: Fix udp fragmentation for tunnel traffic.") changed the calculation if there is enough space to include a fragment header in the skb from a skb->mac_header dervived one to skb_headroom. Because we already peeled off the skb to transport_header this is wrong. This fixes a panic Saran Neti reported. He used the tbf scheduler which skb_gso_segments the skb. The offsets get negative and we panic in memcpy because the skb was erroneously not expanded at the head. Introduced by: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1e2bd517c108816220f262d7954b697af03b5f9c Introduced in: v3.10-rc5 Upstream fix: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0e033e0 References: http://marc.info/?l=linux-netdev&m=138305762205012&w=2 https://bugzilla.redhat.com/show_bug.cgi?id=1030015 Acknowledgements: Red Hat would like to thank Saran Neti of TELUS Security Labs for reporting this issue. Thanks, -- Petr Matousek / Red Hat Security Response Team [ CONTENT OF TYPE application/pgp-signature SKIPPED ]
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ