lkml.org 
[lkml]   [1998]   [Apr]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: The latest ip_fragement bug
   Date: 	Sat, 18 Apr 1998 12:22:59 +0200
From: Guest <guest@manjak.knm.org.pl>

sorry for bothering you with such a trivial problem, but could
anyone explain me what's the problem this time. I'd like to know a
little bit more rather than applying patches without knowing what's
going on.

If you look at the patch, there is a loop which takes each networking
buffer IP fragment, and copies it piece by piece into the final one
networking buffer, which is all the fragments put togther. The code
is in ip_fragment.c:ip_glue()

The loop checks at each copy, whether we're about to copy over the end
of the final buffer, this catches illegal lengths in maliciously
formed IP fragments (actually buggy networking code can produce such
things).

The bug was, we checked this correctly except we did not take into
consideration the size of the IP header at the beginning. So if a
malicious set of fragments had an incorrect length at the end which
only would overrun the final buffer by less than the amount of bytes
in an IP header, we'd write over the end, and go splat.

Later,
David S. Miller
davem@dm.cobaltmicro.com

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu

\
 
 \ /
  Last update: 2005-03-22 13:42    [W:0.039 / U:0.504 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site