Vladis Dronov 9b3dcc98d8 xfrm: policy: check policy direction value ...

commit 7bab09631c upstream.

The 'dir' parameter in xfrm_migrate() is a user-controlled byte which is used
as an array index. This can lead to an out-of-bound access, kernel lockup and
DoS. Add a check for the 'dir' value.

This fixes CVE-2017-11600.

References: https://bugzilla.redhat.com/show_bug.cgi?id=1474928
Fixes: 80c9abaabf ("[XFRM]: Extension for dynamic update of endpoint address(es)")
Reported-by: "bo Zhang" <zhangbo5891001@gmail.com>
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-09-07 08:34:09 +02:00

..

6lowpan

…

9p

p9_client_readdir() fix

2017-05-02 21:19:55 -07:00

802

…

8021q

vlan: Propagate MAC address to VLANs

2017-08-06 19:19:43 -07:00

appletalk

…

atm

…

ax25

…

batman-adv

…

bluetooth

Bluetooth: bnep: fix possible might sleep error in bnep_session

2017-08-30 10:19:26 +02:00

bridge

net: bridge: start hello timer only if device is up

2017-06-14 13:16:19 +02:00

caif

net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx

2017-07-05 14:37:14 +02:00

can

…

ceph

libceph: force GFP_NOIO for socket allocations

2017-04-08 09:53:30 +02:00

core

net: avoid skb_warn_bad_offload false positives on UFO

2017-08-12 19:29:08 -07:00

dcb

…

dccp

dccp: defer ccid_hc_tx_delete() at dismantle time

2017-08-30 10:19:18 +02:00

decnet

decnet: always not take dst->__refcnt when inserting dst into hash table

2017-07-05 14:37:14 +02:00

dns_resolver

…

dsa

net: dsa: Check return value of phy_connect_direct()

2017-07-05 14:37:19 +02:00

ethernet

…

hsr

…

ieee802154

…

ipv4

tcp: when rearming RTO, if RTO time is in past then fire RTO ASAP

2017-08-30 10:19:21 +02:00

ipv6

ipv6: repair fib6 tree in failure case

2017-08-30 10:19:20 +02:00

ipx

ipx: call ipxitf_put() in ioctl error path

2017-05-25 14:30:13 +02:00

irda

irda: do not leak initialized list.dev to userspace

2017-08-30 10:19:21 +02:00

iucv

…

key

af_key: do not use GFP_KERNEL in atomic contexts

2017-08-30 10:19:18 +02:00

l2tp

l2tp: fix PPP pseudo-wire auto-loading

2017-05-02 21:19:52 -07:00

l3mdev

…

lapb

…

llc

net/llc: avoid BUG_ON() in skb_orphan()

2017-02-26 11:07:49 +01:00

mac80211

mac80211: initialize SMPS field in HT capabilities

2017-07-05 14:37:20 +02:00

mac802154

…

mpls

mpls: Send route delete notifications when router module is unloaded

2017-03-22 12:04:16 +01:00

netfilter

netfilter: nf_ct_ext: fix possible panic after nf_ct_extend_unregister

2017-08-24 17:02:34 -07:00

netlabel

…

netlink

netlink: Allow direct reclaim for fallback allocation

2017-05-08 07:46:02 +02:00

netrom

…

nfc

NFC: Add sockaddr length checks before accessing sa_family in bind handlers

2017-07-27 15:06:03 -07:00

openvswitch

openvswitch: fix potential out of bound access in parse_ct

2017-08-11 09:08:53 -07:00

packet

packet: fix tp_reserve race in packet_set_ring

2017-08-12 19:29:08 -07:00

phonet

…

rds

rds: tcp: use sock_create_lite() to create the accept socket

2017-07-21 07:44:55 +02:00

rfkill

…

rose

…

rxrpc

rxrpc: Fix several cases where a padded len isn't checked in ticket decode

2017-06-29 12:48:52 +02:00

sched

net: sched: fix NULL pointer dereference when action calls some targets

2017-08-30 10:19:21 +02:00

sctp

sctp: fully initialize the IPv6 address in sctp_v6_to_addr()

2017-08-30 10:19:19 +02:00

sunrpc

SUNRPC: fix refcounting problems with auth_gss messages.

2017-04-21 09:30:08 +02:00

switchdev

…

tipc

tipc: fix use-after-free

2017-08-30 10:19:20 +02:00

unix

af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers

2017-07-05 14:37:13 +02:00

vmw_vsock

VSOCK: Detach QP check should filter out non matching QPs.

2017-04-27 09:09:32 +02:00

wimax

…

wireless

cfg80211: Check if PMKID attribute is of expected size

2017-07-21 07:44:56 +02:00

x25

…

xfrm

xfrm: policy: check policy direction value

2017-09-07 08:34:09 +02:00

compat.c

…

Kconfig

…

Makefile

…

socket.c

net: socket: fix recvmmsg not returning error from sock_error

2017-02-26 11:07:50 +01:00

sysctl_net.c

…