Patrick McHardy 70a00d8615 [PATCH] NETFILTER: SCTP conntrack: fix crash triggered by packet without chunks [CVE-2006-2934] ...

When a packet without any chunks is received, the newconntrack variable
in sctp_packet contains an out of bounds value that is used to look up an
pointer from the array of timeouts, which is then dereferenced, resulting
in a crash. Make sure at least a single chunk is present.

Problem noticed by George A. Theall <theall@tenablesecurity.com>

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

2006-06-30 14:06:52 -07:00

..

ipvs

…

netfilter

[PATCH] NETFILTER: SCTP conntrack: fix crash triggered by packet without chunks [CVE-2006-2934]

2006-06-30 14:06:52 -07:00

af_inet.c

…

ah4.c

…

arp.c

…

datagram.c

…

devinet.c

[NETLINK]: illegal use of pid in rtnetlink

2006-02-09 16:43:41 -08:00

esp4.c

[IPSEC]: Kill post_input hook and do NAT-T in esp_input directly

2006-02-27 13:00:40 -08:00

fib_frontend.c

x86: Work around compiler code generation bug with -Os

2006-01-14 22:08:28 -08:00

fib_hash.c

…

fib_lookup.h

…

fib_rules.c

…

fib_semantics.c

[NETLINK]: illegal use of pid in rtnetlink

2006-02-09 16:43:41 -08:00

fib_trie.c

[PATCH] fib_trie.c node freeing fix

2006-04-07 09:44:29 -07:00

icmp.c

[IPV4] ICMP: Invert default for invalid icmp msgs sysctl

2006-02-13 15:36:21 -08:00

igmp.c

[PATCH] ipv4 NULL noise removal

2006-02-07 20:57:37 -05:00

inet_connection_sock.c

…

inet_diag.c

…

inet_hashtables.c

…

inet_timewait_sock.c

…

inetpeer.c

…

ip_forward.c

…

ip_fragment.c

…

ip_gre.c

[XFRM]: Fix SNAT-related crash in xfrm4_output_finish

2006-02-15 15:10:22 -08:00

ip_input.c

…

ip_options.c

…

ip_output.c

[PATCH] NETFILTER: Fix fragmentation issues with bridge netfilter

2006-04-17 13:16:04 -07:00

ip_sockglue.c

…

ipcomp.c

…

ipconfig.c

…

ipip.c

[XFRM]: Fix SNAT-related crash in xfrm4_output_finish

2006-02-15 15:10:22 -08:00

ipmr.c

…

Kconfig

…

Makefile

…

multipath_drr.c

…

multipath_random.c

…

multipath_rr.c

…

multipath_wrandom.c

[IPV4] multipath_wrandom: Fix softirq-unsafe spin lock usage

2006-02-02 16:59:16 -08:00

multipath.c

…

netfilter.c

[NETFILTER]: Fix xfrm lookup after SNAT

2006-02-15 01:34:23 -08:00

proc.c

[PATCH] percpu data: only iterate over possible CPUs

2006-02-05 11:06:51 -08:00

protocol.c

…

raw.c

[PATCH] EDAC: atomic scrub operations

2006-01-18 19:20:30 -08:00

route.c

[PATCH] ip_route_input panic fix (CVE-2006-1525)

2006-04-18 14:31:47 -07:00

syncookies.c

…

sysctl_net_ipv4.c

…

tcp_bic.c

…

tcp_cong.c

…

tcp_cubic.c

…

tcp_diag.c

…

tcp_highspeed.c

[TCP]: tcp_highspeed: fix AIMD table out-of-bounds access

2006-03-12 20:39:39 -08:00

tcp_htcp.c

[TCP] H-TCP: Fix accounting

2006-01-30 20:54:39 -08:00

tcp_hybla.c

…

tcp_input.c

[TCP]: rcvbuf lock when tcp_moderate_rcvbuf enabled

2006-02-09 17:06:57 -08:00

tcp_ipv4.c

[NET]: Do not export inet_bind_bucket_create twice.

2006-01-31 17:47:02 -08:00

tcp_minisocks.c

…

tcp_output.c

[PATCH] Fix truesize underflow

2006-04-24 09:56:03 -07:00

tcp_scalable.c

…

tcp_timer.c

…

tcp_vegas.c

…

tcp_westwood.c

…

tcp.c

…

udp.c

…

xfrm4_input.c

…

xfrm4_output.c

[XFRM]: Fix SNAT-related crash in xfrm4_output_finish

2006-02-15 15:10:22 -08:00

xfrm4_policy.c

[IPSEC]: Use TOS when doing tunnel lookups

2006-02-23 16:19:26 -08:00

xfrm4_state.c

[XFRM]: IPsec tunnel wildcard address support

2006-01-13 14:34:36 -08:00

xfrm4_tunnel.c

…