Revision history [back]

The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel through 4.11.3 is too late in checking whether an overwrite of an skb data structure may occur, which allows local users to cause a denial of service (system crash) via crafted system calls.

Upstream Fix available and equal to kernel-3.2 backport.

File affected: kernel-adaptation-sbj-3.4.108.20161101.1/net/ipv6/ip6_output.c lines 1411-1416; 1462-1474

So the Patch should look like:

@@ -1411,6 +1411,11 @@ alloc_new_skb:
         */
        alloclen += sizeof(struct frag_hdr);

+           copy = datalen - transhdrlen - fraggap;
+           if (copy < 0) {
+               err = -EINVAL;
+               goto error;
+           }
        if (transhdrlen) {
            skb = sock_alloc_send_skb(sk,
                    alloclen + hh_len,
@@ -1462,13 +1467,9 @@ alloc_new_skb:
            data += fraggap;
            pskb_trim_unique(skb_prev, maxfraglen);
        }
-           copy = datalen - transhdrlen - fraggap;
-
-           if (copy < 0) {
-               err = -EINVAL;
-               kfree_skb(skb);
-               goto error;
-           } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
+           if (copy > 0 &&
+               getfrag(from, data + transhdrlen, offset,
+                   copy, fraggap, skb) < 0) {
            err = -EFAULT;
            kfree_skb(skb);
            goto error;

The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel through 4.11.3 is too late in checking whether an overwrite of an skb data structure may occur, which allows local users to cause a denial of service (system crash) via crafted system calls.

Upstream Fix available and equal to kernel-3.2 backport.

File affected: kernel-adaptation-sbj-3.4.108.20161101.1/net/ipv6/ip6_output.c lines 1411-1416; 1462-1474

So the Patch should look like:

@@ -1411,6 +1411,11 @@ alloc_new_skb:
         */
        alloclen += sizeof(struct frag_hdr);

+           copy = datalen - transhdrlen - fraggap;
+           if (copy < 0) {
+               err = -EINVAL;
+               goto error;
+           }
        if (transhdrlen) {
            skb = sock_alloc_send_skb(sk,
                    alloclen + hh_len,
@@ -1462,13 +1467,9 @@ alloc_new_skb:
            data += fraggap;
            pskb_trim_unique(skb_prev, maxfraglen);
        }
-           copy = datalen - transhdrlen - fraggap;
-
-           if (copy < 0) {
-               err = -EINVAL;
-               kfree_skb(skb);
-               goto error;
-           } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
+           if (copy > 0 &&
+               getfrag(from, data + transhdrlen, offset,
+                   copy, fraggap, skb) < 0) {
            err = -EFAULT;
            kfree_skb(skb);
            goto error;