github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-10 07:32:29 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
434c32f798
linux/net
History
Ian Wilson 7c6300bb49 netfilter: Zero the tuple in nfnl_cthelper_parse_tuple() 
commit 78146572b9 upstream.

nfnl_cthelper_parse_tuple() is called from nfnl_cthelper_new(),
nfnl_cthelper_get() and nfnl_cthelper_del().  In each case they pass
a pointer to an nf_conntrack_tuple data structure local variable:

    struct nf_conntrack_tuple tuple;
    ...
    ret = nfnl_cthelper_parse_tuple(&tuple, tb[NFCTH_TUPLE]);

The problem is that this local variable is not initialized, and
nfnl_cthelper_parse_tuple() only initializes two fields: src.l3num and
dst.protonum.  This leaves all other fields with undefined values
based on whatever is on the stack:

    tuple->src.l3num = ntohs(nla_get_be16(tb[NFCTH_TUPLE_L3PROTONUM]));
    tuple->dst.protonum = nla_get_u8(tb[NFCTH_TUPLE_L4PROTONUM]);

The symptom observed was that when the rpc and tns helpers were added
then traffic to port 1536 was being sent to user-space.

Signed-off-by: Ian Wilson <iwilson@brocade.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-07-03 19:48:08 -07:00
..
9p 9p/trans_virtio.c: Fix broken zero-copy on vmalloc() buffers 2014-03-06 21:30:03 -08:00
802 net/802/mrp: fix lockdep splat 2013-05-14 13:02:30 -07:00
8021q 8021q: fix a potential memory leak 2014-07-28 08:00:04 -07:00
appletalk appletalk: Fix socket referencing in skb 2014-07-28 08:00:05 -07:00
atm net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
ax25 net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
batman-adv batman-adv: set up network coding packet handlers during module init 2013-11-20 12:27:47 -08:00
bluetooth Bluetooth: Avoid use of session socket after the session gets freed 2014-09-17 09:04:00 -07:00
bridge bridge: fix parsing of MLDv2 reports 2015-06-22 16:55:51 -07:00
caif unix/caif: sk_socket can disappear when state is unlocked 2015-06-22 16:55:51 -07:00
can can: add missing initialisations in CAN related skbuffs 2015-03-26 15:00:58 +01:00
ceph libceph: request a new osdmap if lingering request maps to no osd 2015-06-05 23:19:54 -07:00
core net: sysctl_net_core: check SNDBUF and RCVBUF for min length 2015-03-26 15:00:55 +01:00
dcb net: Use netlink_ns_capable to verify the permisions of netlink messages 2014-06-26 15:12:37 -04:00
dccp net:dccp: do not report ICMP redirects to user space 2013-10-13 16:08:30 -07:00
decnet net: Use netlink_ns_capable to verify the permisions of netlink messages 2014-06-26 15:12:37 -04:00
dns_resolver dns_resolver: Null-terminate the right string 2014-07-28 08:00:06 -07:00
dsa dsa: fix freeing of sparse port allocation 2013-03-25 12:23:41 -04:00
ethernet net: add ETH_P_802_3_MIN 2013-03-28 01:20:42 -04:00
ieee802154 6lowpan: fix lockdep splats 2014-03-06 21:30:02 -08:00
ipv4 udp: fix behavior of wrong checksums 2015-06-22 16:55:51 -07:00
ipv6 udp: fix behavior of wrong checksums 2015-06-22 16:55:51 -07:00
ipx ipx: fix locking regression in ipx_sendmsg and ipx_recvmsg 2014-12-06 15:05:47 -08:00
irda net: irda: fix wait_until_sent poll timeout 2015-03-18 13:22:31 +01:00
iucv af_iucv: wrong mapping of sent and confirmed skbs 2014-06-30 20:09:40 -07:00
key net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
l2tp l2tp: fix race while getting PMTU on PPP pseudo-wire 2014-10-15 08:31:57 +02:00
lapb net/lapb: remove depends on CONFIG_EXPERIMENTAL 2013-01-11 11:40:01 -08:00
llc net: llc: use correct size for sysctl timeout entries 2015-04-19 10:10:50 +02:00
mac80211 mac80211: drop unencrypted frames in mesh fwding 2015-04-13 14:02:11 +02:00
mac802154 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2013-04-30 03:55:20 -04:00
netfilter netfilter: Zero the tuple in nfnl_cthelper_parse_tuple() 2015-07-03 19:48:08 -07:00
netlabel netlabel: improve domain mapping validation 2013-05-19 14:49:55 -07:00
netlink netlink: Don't reorder loads/stores before marking mmap netlink frame as available 2015-01-27 07:52:30 -08:00
netrom net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
nfc net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
openvswitch openvswitch: fix panic with multiple vlan headers 2014-10-15 08:31:57 +02:00
packet packet: handle too big packets for PACKET_V3 2014-10-15 08:31:56 +02:00
phonet net: Use netlink_ns_capable to verify the permisions of netlink messages 2014-06-26 15:12:37 -04:00
rds net: rds: use correct size for max unacked packets and bytes 2015-04-19 10:10:50 +02:00
rfkill Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next 2013-04-22 14:58:14 -04:00
rose net: rose: restore old recvmsg behavior 2014-01-15 15:28:49 -08:00
rxrpc rxrpc: bogus MSG_PEEK test in rxrpc_recvmsg() 2015-03-26 15:00:56 +01:00
sched net_sched: invoke ->attach() after setting dev->qdisc 2015-06-22 16:55:51 -07:00
sctp net: sctp: fix passing wrong parameter header to param_type2af in sctp_process_param 2015-02-26 17:48:49 -08:00
sunrpc svcrpc: fix potential GSSX_ACCEPT_SEC_CONTEXT decoding failures 2015-06-05 23:19:59 -07:00
tipc tipc: clear 'next'-pointer of message fragments before reassembly 2014-07-28 08:00:05 -07:00
unix unix/caif: sk_socket can disappear when state is unlocked 2015-06-22 16:55:51 -07:00
vmw_vsock net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
wimax
wireless cfg80211: wext: clear sinfo struct before calling driver 2015-06-22 16:55:54 -07:00
x25 net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
xfrm net: Use netlink_ns_capable to verify the permisions of netlink messages 2014-06-26 15:12:37 -04:00
compat.c net: compat: Update get_compat_msghdr() to match copy_msghdr_from_user() behaviour 2015-03-26 15:00:56 +01:00
Kconfig netlink: kconfig: move mmap i/o into netlink kconfig 2013-05-01 15:02:42 -04:00
Makefile VSOCK: Introduce VM Sockets 2013-02-10 19:41:08 -05:00
nonet.c
socket.c net: socket: Fix the wrong returns for recvmsg and sendmsg 2015-06-05 23:19:53 -07:00
sysctl_net.c net: Update the sysctl permissions handler to test effective uid/gid 2013-10-13 16:08:34 -07:00