Messages in this thread | | | Date | Sat, 18 Apr 1998 04:02:36 -0700 | From | "David S. Miller" <> | Subject | Re: The latest ip_fragement bug |
| |
Date: Sat, 18 Apr 1998 12:22:59 +0200 From: Guest <guest@manjak.knm.org.pl>
sorry for bothering you with such a trivial problem, but could anyone explain me what's the problem this time. I'd like to know a little bit more rather than applying patches without knowing what's going on.
If you look at the patch, there is a loop which takes each networking buffer IP fragment, and copies it piece by piece into the final one networking buffer, which is all the fragments put togther. The code is in ip_fragment.c:ip_glue()
The loop checks at each copy, whether we're about to copy over the end of the final buffer, this catches illegal lengths in maliciously formed IP fragments (actually buggy networking code can produce such things).
The bug was, we checked this correctly except we did not take into consideration the size of the IP header at the beginning. So if a malicious set of fragments had an incorrect length at the end which only would overrun the final buffer by less than the amount of bytes in an IP header, we'd write over the end, and go splat.
Later, David S. Miller davem@dm.cobaltmicro.com
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu
| |