Re: [PATCH v2] net: ping: check minimum size on ICMP header length

From	David Miller <davem@davemloft.net>
Newsgroups	linux.kernel
Subject	Re: [PATCH v2] net: ping: check minimum size on ICMP header length
Date	2016-12-05 19:40 +0100
Message-ID	<sL6lc-87B-17@gated-at.bofh.it> (permalink)
References	<sL6lb-87B-11@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

From: Kees Cook <keescook@chromium.org>
Date: Mon, 5 Dec 2016 10:34:38 -0800

> Prior to commit c0371da6047a ("put iov_iter into msghdr") in v3.19, there
> was no check that the iovec contained enough bytes for an ICMP header,
> and the read loop would walk across neighboring stack contents. Since the
> iov_iter conversion, bad arguments are noticed, but the returned error is
> EFAULT. Returning EINVAL is a clearer error and also solves the problem
> prior to v3.19.
> 
> This was found using trinity with KASAN on v3.18:
 ...
> CVE-2016-8399
> 
> Reported-by: Qidan He <i@flanker017.me>
> Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind")
> Cc: stable@vger.kernel.org
> Signed-off-by: Kees Cook <keescook@chromium.org>

Applied and queued up for -stable, thanks.

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[PATCH v2] net: ping: check minimum size on ICMP header length Kees Cook <keescook@chromium.org> - 2016-12-05 19:40 +0100
  Re: [PATCH v2] net: ping: check minimum size on ICMP header length David Miller <davem@davemloft.net> - 2016-12-05 19:40 +0100

csiph-web