From 6ba834ef50e5bd7debb89528cd129e5d0818e23c Mon Sep 17 00:00:00 2001 From: Sona Sarmadi Date: Tue, 5 Jan 2016 13:33:13 +0100 Subject: kernel-rds: CVE-2015-2042 Fixes information handling flaw in rds sysctl files. Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2042 Upstream fix: https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/ patch/?id=2a9eb844a4c126b7e975a086f99f35699e88c011 Signed-off-by: Sona Sarmadi Signed-off-by: Tudor Florea --- .../linux/files/net-rds-CVE-2015-2042.patch | 47 ++++++++++++++++++++++ recipes-kernel/linux/linux-yocto_3.14.bbappend | 1 + 2 files changed, 48 insertions(+) create mode 100644 recipes-kernel/linux/files/net-rds-CVE-2015-2042.patch diff --git a/recipes-kernel/linux/files/net-rds-CVE-2015-2042.patch b/recipes-kernel/linux/files/net-rds-CVE-2015-2042.patch new file mode 100644 index 0000000..b8c407e --- /dev/null +++ b/recipes-kernel/linux/files/net-rds-CVE-2015-2042.patch @@ -0,0 +1,47 @@ +From 2a9eb844a4c126b7e975a086f99f35699e88c011 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Subject: net: rds: use correct size for max unacked packets and bytes + +commit db27ebb111e9f69efece08e4cb6a34ff980f8896 upstream. + +Max unacked packets/bytes is an int while sizeof(long) was used in the +sysctl table. + +This means that when they were getting read we'd also leak kernel memory +to userspace along with the timeout values. + +Fixes CVE-2015-2041. +Upstream-Status: Backport + +Signed-off-by: Sasha Levin +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sona Sarmadi +--- + net/rds/sysctl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/rds/sysctl.c b/net/rds/sysctl.c +index b5cb2aa..35773ad 100644 +--- a/net/rds/sysctl.c ++++ b/net/rds/sysctl.c +@@ -71,14 +71,14 @@ static struct ctl_table rds_sysctl_rds_table[] = { + { + .procname = "max_unacked_packets", + .data = &rds_sysctl_max_unacked_packets, +- .maxlen = sizeof(unsigned long), ++ .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_dointvec, + }, + { + .procname = "max_unacked_bytes", + .data = &rds_sysctl_max_unacked_bytes, +- .maxlen = sizeof(unsigned long), ++ .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_dointvec, + }, +-- +cgit v0.11.2 + diff --git a/recipes-kernel/linux/linux-yocto_3.14.bbappend b/recipes-kernel/linux/linux-yocto_3.14.bbappend index 326066a..30d6561 100644 --- a/recipes-kernel/linux/linux-yocto_3.14.bbappend +++ b/recipes-kernel/linux/linux-yocto_3.14.bbappend @@ -12,4 +12,5 @@ SRC_URI += "file://HID_CVE_patches/0005-HID-steelseries-validate-output-report-d file://md-CVE-2015-5697.patch \ file://vhost-CVE-2015-6252.patch \ file://ipv4-CVE-2015-1465.patch \ + file://net-rds-CVE-2015-2042.patch \ " -- cgit v1.2.3-54-g00ecf