From: Al Viro Date: Wed, 31 Aug 2005 09:55:12 +0000 (+0100) Subject: [PATCH] raw_sendmsg DoS (CAN-2005-2492) X-Git-Tag: v2.6.13.1~1 X-Git-Url: https://git.fsl.cs.sunysb.edu/?a=commitdiff_plain;h=0721a681c617fdd498f2f0f40e69895354baf099;p=unionfs-2.6.39.y.git [PATCH] raw_sendmsg DoS (CAN-2005-2492) Fix unchecked __get_user that could be tricked into generating a memory read on an arbitrary address. The result of the read is not returned directly but you may be able to divine some information about it, or use the read to cause a crash on some architectures by reading hardware state. CAN-2005-2492. Fix from Al Viro, ack from Dave Miller. Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman --- diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c index d1835b1bc8c..1364115e16b 100644 --- a/net/ipv4/raw.c +++ b/net/ipv4/raw.c @@ -358,7 +358,7 @@ static void raw_probe_proto_opt(struct flowi *fl, struct msghdr *msg) if (type && code) { get_user(fl->fl_icmp_type, type); - __get_user(fl->fl_icmp_code, code); + get_user(fl->fl_icmp_code, code); probed = 1; } break; diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c index 1d4d75b34d3..1c72d49f779 100644 --- a/net/ipv6/raw.c +++ b/net/ipv6/raw.c @@ -619,7 +619,7 @@ static void rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg) if (type && code) { get_user(fl->fl_icmp_type, type); - __get_user(fl->fl_icmp_code, code); + get_user(fl->fl_icmp_code, code); probed = 1; } break;