lkml.org 
[lkml]   [2012]   [Sep]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[ 35/95] dccp: check ccid before dereferencing
    3.2-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Mathias Krause <minipli@googlemail.com>

    commit 276bdb82dedb290511467a5a4fdbe9f0b52dce6f upstream.

    ccid_hc_rx_getsockopt() and ccid_hc_tx_getsockopt() might be called with
    a NULL ccid pointer leading to a NULL pointer dereference. This could
    lead to a privilege escalation if the attacker is able to map page 0 and
    prepare it with a fake ccid_ops pointer.

    Signed-off-by: Mathias Krause <minipli@googlemail.com>
    Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    net/dccp/ccid.h | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    diff --git a/net/dccp/ccid.h b/net/dccp/ccid.h
    index 75c3582..fb85d37 100644
    --- a/net/dccp/ccid.h
    +++ b/net/dccp/ccid.h
    @@ -246,7 +246,7 @@ static inline int ccid_hc_rx_getsockopt(struct ccid *ccid, struct sock *sk,
    u32 __user *optval, int __user *optlen)
    {
    int rc = -ENOPROTOOPT;
    - if (ccid->ccid_ops->ccid_hc_rx_getsockopt != NULL)
    + if (ccid != NULL && ccid->ccid_ops->ccid_hc_rx_getsockopt != NULL)
    rc = ccid->ccid_ops->ccid_hc_rx_getsockopt(sk, optname, len,
    optval, optlen);
    return rc;
    @@ -257,7 +257,7 @@ static inline int ccid_hc_tx_getsockopt(struct ccid *ccid, struct sock *sk,
    u32 __user *optval, int __user *optlen)
    {
    int rc = -ENOPROTOOPT;
    - if (ccid->ccid_ops->ccid_hc_tx_getsockopt != NULL)
    + if (ccid != NULL && ccid->ccid_ops->ccid_hc_tx_getsockopt != NULL)
    rc = ccid->ccid_ops->ccid_hc_tx_getsockopt(sk, optname, len,
    optval, optlen);
    return rc;



    \
     
     \ /
      Last update: 2012-09-10 02:41    [W:0.025 / U:215.124 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site