luck/tmp_suning_uos_patched
1
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[PATCH] raw_sendmsg DoS on 2.6

Browse Source 
Fix unchecked __get_user that could be tricked into generating a
memory read on an arbitrary address.  The result of the read is not
returned directly but you may be able to divine some information about
it, or use the read to cause a crash on some architectures by reading
hardware state.  CAN-2004-2492.

Fix from Al Viro, ack from Dave Miller.

Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
Mark J Cox 2005-09-19 17:55:30 -07:00 committed by Linus Torvalds
parent 997a51ae37
commit 6d1cfe3f17
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
net/ipv4/raw.c
View File

@ -361,7 +361,7 @@ static void raw_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
if (type && code) {
get_user(fl->fl_icmp_type, type);
__get_user(fl->fl_icmp_code, code);
get_user(fl->fl_icmp_code, code);
probed = 1;
}
break;

2
net/ipv6/raw.c
View File

@ -627,7 +627,7 @@ static void rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
if (type && code) {
get_user(fl->fl_icmp_type, type);
__get_user(fl->fl_icmp_code, code);
get_user(fl->fl_icmp_code, code);
probed = 1;
}
break;