lkml.org 
[lkml]   [1996]   [Oct]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    SubjectRe: kernel bug -> security problem
    Date
    	Perhaps if you read the list, you would have seen this patch: :-)

    - Jared


    From: Jon Lewis <jlewis@inorganic5.fdt.net>
    To: linux-kernel@vger.rutgers.edu
    cc: Alan Cox <iialan@iifeak.swan.ac.uk>,
    Linus Torvalds <torvalds@cc.helsinki.fi>

    This slightly modified version of Alan Cox's ping patch has been tested on
    my SMP test box. Without it, I can crash it from a Win95 box, and then
    softdog (I assume) reboots it. With the patch, Win95 doesn't seem able to
    crash it. I'm now running this patch on 5 other systems.

    Is there anything other than someone trying to crash my box that would
    trigger the printk I added? One of our servers just logged this:

    Oversized packet received from 205.229.51.6

    That's one of our dialup user IP addresses. Are my own users trying to
    crash me, or is it just a Windows IP bug? If there's no explanation other
    than someone trying to crash our mail server, I'd like to terminate that
    account.

    --- ip_fragment.c.orig Wed Aug 7 07:00:08 1996
    +++ ip_fragment.c Sat Oct 19 20:33:42 1996
    @@ -47,6 +47,8 @@

    atomic_t ip_frag_mem = 0; /* Memory used for fragments */

    +char *in_ntoa(unsigned long in);
    +
    /*
    * Memory Tracking Functions
    */
    @@ -366,7 +368,7 @@
    {
    NETDEBUG(printk("Invalid fragment list: Fragment over size.\n"));
    ip_free(qp);
    - frag_kfree_skb(skb,FREE_WRITE);
    + kfree_skb(skb,FREE_WRITE);
    ip_statistics.IpReasmFails++;
    return NULL;
    }
    @@ -466,6 +468,19 @@
    return NULL;
    }
    }
    +
    + /*
    + * Attempt to construct an oversize packet.
    + */
    +
    + if(ntohs(iph->tot_len)+(int)offset>65535)
    + {
    + skb->sk = NULL;
    + printk("Oversized packet received from %s\n",in_ntoa(qp->iph->saddr));
    + frag_kfree_skb(skb, FREE_READ);
    + ip_statistics.IpReasmFails++;
    + return NULL;
    + }

    /*
    * Determine the position of this fragment.


    ------------------------------------------------------------------
    Jon Lewis <jlewis@fdt.net> | Unsolicited commercial e-mail will
    Network Administrator | be proof-read for $199/hr.
    ________Finger jlewis@inorganic5.fdt.net for PGP public key_______

    Jacek Radajewski graced my mailbox with this long sought knowledge:
    >
    > Hi,
    >
    > I've just received e-mail about a bug in the kernel which causes linux
    > to reboot when the following ping is issued from windowz 95 : "ping -l
    > 65510 linux.box.IP.address" .. I tried it and sure enough linux dies
    > quickly and without any warning ...
    >
    >
    > Has someone got more info on this ??? is there a fix ?
    >
    > Cheers
    >
    > Jacek - jacek@usq.edu.au
    >
    >


    \
     
     \ /
      Last update: 2005-03-22 13:38    [W:0.020 / U:395.132 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site