Cipso: CVE-2018-10938

Cipso: cipso_v4_optptr enter infinite loop

References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=40413955ee265a5e42f710940ec78f5450d49149

Change-Id: I2ddd252e706cc611c1b62175c1bd6ea1874a7974
Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>

2 files changed, 50 insertions, 0 deletions

diff --git a/patches/cve/4.9.x.scc b/patches/cve/4.9.x.scc
index a296f8e..eef4955 100644
--- a/patches/cve/4.9.x.scc
+++ b/patches/cve/4.9.x.scc
@@ -9,3 +9,6 @@ patch CVE-2018-15572-x86-speculation-Protect-against-userspace-userspace-.patch
 
 #CVEs fixed in 4.9.121:
 patch CVE-2018-9363-Bluetooth-hidp-buffer-overflow-in-hidp_process_repor.patch
+
+#CVEs fixed in 4.9.125:
+patch CVE-2018-10938-Cipso-cipso_v4_optptr-enter-infinite-loop.patch
diff --git a/patches/cve/CVE-2018-10938-Cipso-cipso_v4_optptr-enter-infinite-loop.patch b/patches/cve/CVE-2018-10938-Cipso-cipso_v4_optptr-enter-infinite-loop.patch
new file mode 100644
index 0000000..68a5d28
--- /dev/null
+++ b/patches/cve/CVE-2018-10938-Cipso-cipso_v4_optptr-enter-infinite-loop.patch
@@ -0,0 +1,47 @@
+From 40413955ee265a5e42f710940ec78f5450d49149 Mon Sep 17 00:00:00 2001
+From: "yujuan.qi" <yujuan.qi@mediatek.com>
+Date: Mon, 31 Jul 2017 11:23:01 +0800
+Subject: [PATCH] Cipso: cipso_v4_optptr enter infinite loop
+
+in for(),if((optlen > 0) && (optptr[1] == 0)), enter infinite loop.
+
+Test: receive a packet which the ip length > 20 and the first byte of ip option is 0, produce this issue
+
+CVE: CVE-2018-10938   
+Upstream-Status: Backport  
+
+Signed-off-by: yujuan.qi <yujuan.qi@mediatek.com>
+Acked-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
+---
+ net/ipv4/cipso_ipv4.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
+index c4c6e19..2ae8f54 100644
+--- a/net/ipv4/cipso_ipv4.c
++++ b/net/ipv4/cipso_ipv4.c
+@@ -1523,9 +1523,17 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
+        int taglen;
+ 
+        for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) {
+-               if (optptr[0] == IPOPT_CIPSO)
++               switch (optptr[0]) {
++               case IPOPT_CIPSO:
+                        return optptr;
+-               taglen = optptr[1];
++               case IPOPT_END:
++                       return NULL;
++               case IPOPT_NOOP:
++                       taglen = 1;
++                       break;
++               default:
++                       taglen = optptr[1];
++               }
+                optlen -= taglen;
+                optptr += taglen;
+        }
+-- 
+2.7.4
+