From 881dab83a4597d7c0e7ca75ccee3d8038ac1b31d Mon Sep 17 00:00:00 2001 From: Andreas Wellving Date: Fri, 12 Oct 2018 08:07:26 +0200 Subject: Cipso: CVE-2018-10938 Cipso: cipso_v4_optptr enter infinite loop References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=40413955ee265a5e42f710940ec78f5450d49149 Change-Id: I2ddd252e706cc611c1b62175c1bd6ea1874a7974 Signed-off-by: Andreas Wellving --- patches/cve/4.9.x.scc | 3 ++ ...Cipso-cipso_v4_optptr-enter-infinite-loop.patch | 47 ++++++++++++++++++++++ 2 files changed, 50 insertions(+) create mode 100644 patches/cve/CVE-2018-10938-Cipso-cipso_v4_optptr-enter-infinite-loop.patch diff --git a/patches/cve/4.9.x.scc b/patches/cve/4.9.x.scc index a296f8e..eef4955 100644 --- a/patches/cve/4.9.x.scc +++ b/patches/cve/4.9.x.scc @@ -9,3 +9,6 @@ patch CVE-2018-15572-x86-speculation-Protect-against-userspace-userspace-.patch #CVEs fixed in 4.9.121: patch CVE-2018-9363-Bluetooth-hidp-buffer-overflow-in-hidp_process_repor.patch + +#CVEs fixed in 4.9.125: +patch CVE-2018-10938-Cipso-cipso_v4_optptr-enter-infinite-loop.patch diff --git a/patches/cve/CVE-2018-10938-Cipso-cipso_v4_optptr-enter-infinite-loop.patch b/patches/cve/CVE-2018-10938-Cipso-cipso_v4_optptr-enter-infinite-loop.patch new file mode 100644 index 0000000..68a5d28 --- /dev/null +++ b/patches/cve/CVE-2018-10938-Cipso-cipso_v4_optptr-enter-infinite-loop.patch @@ -0,0 +1,47 @@ +From 40413955ee265a5e42f710940ec78f5450d49149 Mon Sep 17 00:00:00 2001 +From: "yujuan.qi" +Date: Mon, 31 Jul 2017 11:23:01 +0800 +Subject: [PATCH] Cipso: cipso_v4_optptr enter infinite loop + +in for(),if((optlen > 0) && (optptr[1] == 0)), enter infinite loop. + +Test: receive a packet which the ip length > 20 and the first byte of ip option is 0, produce this issue + +CVE: CVE-2018-10938 +Upstream-Status: Backport + +Signed-off-by: yujuan.qi +Acked-by: Paul Moore +Signed-off-by: David S. Miller +Signed-off-by: Andreas Wellving +--- + net/ipv4/cipso_ipv4.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c +index c4c6e19..2ae8f54 100644 +--- a/net/ipv4/cipso_ipv4.c ++++ b/net/ipv4/cipso_ipv4.c +@@ -1523,9 +1523,17 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb) + int taglen; + + for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) { +- if (optptr[0] == IPOPT_CIPSO) ++ switch (optptr[0]) { ++ case IPOPT_CIPSO: + return optptr; +- taglen = optptr[1]; ++ case IPOPT_END: ++ return NULL; ++ case IPOPT_NOOP: ++ taglen = 1; ++ break; ++ default: ++ taglen = optptr[1]; ++ } + optlen -= taglen; + optptr += taglen; + } +-- +2.7.4 + -- cgit v1.2.3-54-g00ecf