Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

(Compile fix) Fix backported security fix for CVE-2020-14386 #51

Closed
wants to merge 2 commits into from
Closed

(Compile fix) Fix backported security fix for CVE-2020-14386 #51

wants to merge 2 commits into from

Commits on Sep 9, 2020

  1. backport: net/packet: fix overflow in tpacket_rcv 

    Using tp_reserve to calculate netoff can overflow as
tp_reserve is unsigned int and netoff is unsigned short.

This may lead to macoff receving a smaller value then
sizeof(struct virtio_net_hdr), and if po->has_vnet_hdr
is set, an out-of-bounds write will occur when
calling virtio_net_hdr_from_skb.

The bug is fixed by converting netoff to unsigned int
and checking if it exceeds USHRT_MAX.

This addresses CVE-2020-14386

Fixes: 8913336 ("packet: add PACKET_RESERVE sockopt")
Signed-off-by: Or Cohen <orcohen@paloaltonetworks.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
    @anthraxx
    Or Cohen authored and anthraxx committed Sep 9, 2020
    Configuration menu
    Copy the full SHA
    8916555 View commit details
    Browse the repository at this point in the history

Commits on Sep 12, 2020

  1. backport: net/packet: make tp_drops atomic 

    Under DDOS, we want to be able to increment tp_drops without
touching the spinlock. This will help readers to drain
the receive queue slightly faster :/

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
    @flawedworld
    Eric Dumazet authored and flawedworld committed Sep 12, 2020
    Configuration menu
    Copy the full SHA
    7c2e88c View commit details
    Browse the repository at this point in the history