* [PATCH] DCCP: proper optlen checking in do_dccp_getsockopt()
@ 2007-03-28 18:49 Jiri Kosina
2007-03-28 18:59 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Jiri Kosina @ 2007-03-28 18:49 UTC (permalink / raw)
To: Andrew Morton, Arnaldo Carvalho de Melo
Cc: Robert Święcki, linux-kernel
[-- Attachment #1: Type: TEXT/PLAIN, Size: 850 bytes --]
From: Jiri Kosina <jkosina@suse.cz>
DCCP: proper optlen checking in do_dccp_getsockopt()
Robert Swiecki discovered [1] a signedness bug in checking of
optlen in do_dccp_getsockopt(). This bug can allow user to
read parts of the kernel memory.
[1] http://www.securityfocus.com/archive/1/463934/30/0/threaded
Cc: Robert Święcki <jagger@swiecki.net>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
net/dccp/proto.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index cf28c53..5239f26 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -575,7 +575,7 @@ static int do_dccp_getsockopt(struct sock *sk, int level, int optname,
if (get_user(len, optlen))
return -EFAULT;
- if (len < sizeof(int))
+ if (len < 1)
return -EINVAL;
dp = dccp_sk(sk);
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] DCCP: proper optlen checking in do_dccp_getsockopt()
2007-03-28 18:49 [PATCH] DCCP: proper optlen checking in do_dccp_getsockopt() Jiri Kosina
@ 2007-03-28 18:59 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2007-03-28 18:59 UTC (permalink / raw)
To: jkosina; +Cc: akpm, acme, jagger, linux-kernel
From: Jiri Kosina <jkosina@suse.cz>
Date: Wed, 28 Mar 2007 20:49:32 +0200 (CEST)
> From: Jiri Kosina <jkosina@suse.cz>
>
> DCCP: proper optlen checking in do_dccp_getsockopt()
>
> Robert Swiecki discovered [1] a signedness bug in checking of
> optlen in do_dccp_getsockopt(). This bug can allow user to
> read parts of the kernel memory.
>
> [1] http://www.securityfocus.com/archive/1/463934/30/0/threaded
Arnaldo already sent me a more proper fix for this.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2007-03-28 18:59 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2007-03-28 18:49 [PATCH] DCCP: proper optlen checking in do_dccp_getsockopt() Jiri Kosina
2007-03-28 18:59 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®