Skip to content

Commit e64b4bc

Browse files
raymanfxraymanfx
committed
patches: Add a few 2014 CVE patchfiles
1 parent 97a434e commit e64b4bc

16 files changed

+1200
-0
lines changed

‎patches/3.10/CVE-2014-0196.patch

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
From 4291086b1f081b869c6d79e5b7441633dc3ace00 Mon Sep 17 00:00:00 2001
2+
From: Peter Hurley <peter@hurleysoftware.com>
3+
Date: Sat, 3 May 2014 14:04:59 +0200
4+
Subject: [PATCH] n_tty: Fix n_tty_write crash when echoing in raw mode
5+
6+
The tty atomic_write_lock does not provide an exclusion guarantee for
7+
the tty driver if the termios settings are LECHO & !OPOST. And since
8+
it is unexpected and not allowed to call TTY buffer helpers like
9+
tty_insert_flip_string concurrently, this may lead to crashes when
10+
concurrect writers call pty_write. In that case the following two
11+
writers:
12+
* the ECHOing from a workqueue and
13+
* pty_write from the process
14+
race and can overflow the corresponding TTY buffer like follows.
15+
16+
If we look into tty_insert_flip_string_fixed_flag, there is:
17+
int space = __tty_buffer_request_room(port, goal, flags);
18+
struct tty_buffer *tb = port->buf.tail;
19+
...
20+
memcpy(char_buf_ptr(tb, tb->used), chars, space);
21+
...
22+
tb->used += space;
23+
24+
so the race of the two can result in something like this:
25+
A B
26+
__tty_buffer_request_room
27+
__tty_buffer_request_room
28+
memcpy(buf(tb->used), ...)
29+
tb->used += space;
30+
memcpy(buf(tb->used), ...) ->BOOM
31+
32+
B's memcpy is past the tty_buffer due to the previous A's tb->used
33+
increment.
34+
35+
Since the N_TTY line discipline input processing can output
36+
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
37+
serialize echo output with normal tty writes. This ensures the tty
38+
buffer helper tty_insert_flip_string is not called concurrently and
39+
everything is fine.
40+
41+
Note that this is nicely reproducible by an ordinary user using
42+
forkpty and some setup around that (raw termios + ECHO). And it is
43+
present in kernels at least after commit
44+
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
45+
use the normal buffering logic) in 2.6.31-rc3.
46+
47+
js: add more info to the commit log
48+
js: switch to bool
49+
js: lock unconditionally
50+
js: lock only the tty->ops->write call
51+
52+
References: CVE-2014-0196
53+
Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
54+
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
55+
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
56+
Cc: Linus Torvalds <torvalds@linux-foundation.org>
57+
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
58+
Cc: <stable@vger.kernel.org>
59+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
60+
---
61+
drivers/tty/n_tty.c | 4 ++++
62+
1 file changed, 4 insertions(+)
63+
64+
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
65+
index 41fe8a04..fe9d129 100644
66+
--- a/drivers/tty/n_tty.c
67+
+++ b/drivers/tty/n_tty.c
68+
@@ -2353,8 +2353,12 @@ static ssize_t n_tty_write(struct tty_struct *tty, struct file *file,
69+
if (tty->ops->flush_chars)
70+
tty->ops->flush_chars(tty);
71+
} else {
72+
+ struct n_tty_data *ldata = tty->disc_data;
73+
+
74+
while (nr > 0) {
75+
+ mutex_lock(&ldata->output_lock);
76+
c = tty->ops->write(tty, b, nr);
77+
+ mutex_unlock(&ldata->output_lock);
78+
if (c < 0) {
79+
retval = c;
80+
goto break_out;

‎patches/3.10/CVE-2014-2523.patch

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
From b22f5126a24b3b2f15448c3f2a254fc10cbc2b92 Mon Sep 17 00:00:00 2001
2+
From: Daniel Borkmann <dborkman@redhat.com>
3+
Date: Mon, 6 Jan 2014 00:57:54 +0100
4+
Subject: [PATCH] netfilter: nf_conntrack_dccp: fix skb_header_pointer API
5+
usages
6+
7+
Some occurences in the netfilter tree use skb_header_pointer() in
8+
the following way ...
9+
10+
struct dccp_hdr _dh, *dh;
11+
...
12+
skb_header_pointer(skb, dataoff, sizeof(_dh), &dh);
13+
14+
... where dh itself is a pointer that is being passed as the copy
15+
buffer. Instead, we need to use &_dh as the forth argument so that
16+
we're copying the data into an actual buffer that sits on the stack.
17+
18+
Currently, we probably could overwrite memory on the stack (e.g.
19+
with a possibly mal-formed DCCP packet), but unintentionally, as
20+
we only want the buffer to be placed into _dh variable.
21+
22+
Fixes: 2bc780499aa3 ("[NETFILTER]: nf_conntrack: add DCCP protocol support")
23+
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
24+
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
25+
---
26+
net/netfilter/nf_conntrack_proto_dccp.c | 6 +++---
27+
1 file changed, 3 insertions(+), 3 deletions(-)
28+
29+
diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c
30+
index 3841268..cb372f9 100644
31+
--- a/net/netfilter/nf_conntrack_proto_dccp.c
32+
+++ b/net/netfilter/nf_conntrack_proto_dccp.c
33+
@@ -428,7 +428,7 @@ static bool dccp_new(struct nf_conn *ct, const struct sk_buff *skb,
34+
const char *msg;
35+
u_int8_t state;
36+
37+
- dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &dh);
38+
+ dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh);
39+
BUG_ON(dh == NULL);
40+
41+
state = dccp_state_table[CT_DCCP_ROLE_CLIENT][dh->dccph_type][CT_DCCP_NONE];
42+
@@ -486,7 +486,7 @@ static int dccp_packet(struct nf_conn *ct, const struct sk_buff *skb,
43+
u_int8_t type, old_state, new_state;
44+
enum ct_dccp_roles role;
45+
46+
- dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &dh);
47+
+ dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh);
48+
BUG_ON(dh == NULL);
49+
type = dh->dccph_type;
50+
51+
@@ -577,7 +577,7 @@ static int dccp_error(struct net *net, struct nf_conn *tmpl,
52+
unsigned int cscov;
53+
const char *msg;
54+
55+
- dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &dh);
56+
+ dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh);
57+
if (dh == NULL) {
58+
msg = "nf_ct_dccp: short packet ";
59+
goto out_invalid;

‎patches/3.10/CVE-2014-2851.patch

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
From b04c46190219a4f845e46a459e3102137b7f6cac Mon Sep 17 00:00:00 2001
2+
From: "Wang, Xiaoming" <xiaoming.wang@intel.com>
3+
Date: Mon, 14 Apr 2014 12:30:45 -0400
4+
Subject: net: ipv4: current group_info should be put after using.
5+
6+
Plug a group_info refcount leak in ping_init.
7+
group_info is only needed during initialization and
8+
the code failed to release the reference on exit.
9+
While here move grabbing the reference to a place
10+
where it is actually needed.
11+
12+
Signed-off-by: Chuansheng Liu <chuansheng.liu@intel.com>
13+
Signed-off-by: Zhang Dongxing <dongxing.zhang@intel.com>
14+
Signed-off-by: xiaoming wang <xiaoming.wang@intel.com>
15+
Signed-off-by: David S. Miller <davem@davemloft.net>
16+
---
17+
net/ipv4/ping.c | 15 +++++++++++----
18+
1 file changed, 11 insertions(+), 4 deletions(-)
19+
20+
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
21+
index f4b19e5..8210964 100644
22+
--- a/net/ipv4/ping.c
23+
+++ b/net/ipv4/ping.c
24+
@@ -252,26 +252,33 @@ int ping_init_sock(struct sock *sk)
25+
{
26+
struct net *net = sock_net(sk);
27+
kgid_t group = current_egid();
28+
- struct group_info *group_info = get_current_groups();
29+
- int i, j, count = group_info->ngroups;
30+
+ struct group_info *group_info;
31+
+ int i, j, count;
32+
kgid_t low, high;
33+
+ int ret = 0;
34+
35+
inet_get_ping_group_range_net(net, &low, &high);
36+
if (gid_lte(low, group) && gid_lte(group, high))
37+
return 0;
38+
39+
+ group_info = get_current_groups();
40+
+ count = group_info->ngroups;
41+
for (i = 0; i < group_info->nblocks; i++) {
42+
int cp_count = min_t(int, NGROUPS_PER_BLOCK, count);
43+
for (j = 0; j < cp_count; j++) {
44+
kgid_t gid = group_info->blocks[i][j];
45+
if (gid_lte(low, gid) && gid_lte(gid, high))
46+
- return 0;
47+
+ goto out_release_group;
48+
}
49+
50+
count -= cp_count;
51+
}
52+
53+
- return -EACCES;
54+
+ ret = -EACCES;
55+
+
56+
+out_release_group:
57+
+ put_group_info(group_info);
58+
+ return ret;
59+
}
60+
EXPORT_SYMBOL_GPL(ping_init_sock);
61+
62+
--
63+
cgit v1.1
64+

‎patches/3.10/CVE-2014-3145.patch

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
From 314760e66c35c8ffa51b4c4ca6948d207e783079 Mon Sep 17 00:00:00 2001
2+
From: Mathias Krause <minipli@googlemail.com>
3+
Date: Sun, 13 Apr 2014 18:23:33 +0200
4+
Subject: filter: prevent nla extensions to peek beyond the end of the message
5+
6+
[ Upstream commit 05ab8f2647e4221cbdb3856dd7d32bd5407316b3 ]
7+
8+
The BPF_S_ANC_NLATTR and BPF_S_ANC_NLATTR_NEST extensions fail to check
9+
for a minimal message length before testing the supplied offset to be
10+
within the bounds of the message. This allows the subtraction of the nla
11+
header to underflow and therefore -- as the data type is unsigned --
12+
allowing far to big offset and length values for the search of the
13+
netlink attribute.
14+
15+
The remainder calculation for the BPF_S_ANC_NLATTR_NEST extension is
16+
also wrong. It has the minuend and subtrahend mixed up, therefore
17+
calculates a huge length value, allowing to overrun the end of the
18+
message while looking for the netlink attribute.
19+
20+
The following three BPF snippets will trigger the bugs when attached to
21+
a UNIX datagram socket and parsing a message with length 1, 2 or 3.
22+
23+
,-[ PoC for missing size check in BPF_S_ANC_NLATTR ]--
24+
| ld #0x87654321
25+
| ldx #42
26+
| ld #nla
27+
| ret a
28+
`---
29+
30+
,-[ PoC for the same bug in BPF_S_ANC_NLATTR_NEST ]--
31+
| ld #0x87654321
32+
| ldx #42
33+
| ld #nlan
34+
| ret a
35+
`---
36+
37+
,-[ PoC for wrong remainder calculation in BPF_S_ANC_NLATTR_NEST ]--
38+
| ; (needs a fake netlink header at offset 0)
39+
| ld #0
40+
| ldx #42
41+
| ld #nlan
42+
| ret a
43+
`---
44+
45+
Fix the first issue by ensuring the message length fulfills the minimal
46+
size constrains of a nla header. Fix the second bug by getting the math
47+
for the remainder calculation right.
48+
49+
Fixes: 4738c1db15 ("[SKFILTER]: Add SKF_ADF_NLATTR instruction")
50+
Fixes: d214c7537b ("filter: add SKF_AD_NLATTR_NEST to look for nested..")
51+
Cc: Patrick McHardy <kaber@trash.net>
52+
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
53+
Signed-off-by: Mathias Krause <minipli@googlemail.com>
54+
Acked-by: Daniel Borkmann <dborkman@redhat.com>
55+
Signed-off-by: David S. Miller <davem@davemloft.net>
56+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
57+
---
58+
net/core/filter.c | 6 +++++-
59+
1 file changed, 5 insertions(+), 1 deletion(-)
60+
61+
diff --git a/net/core/filter.c b/net/core/filter.c
62+
index 52f01229..c6c18d8 100644
63+
--- a/net/core/filter.c
64+
+++ b/net/core/filter.c
65+
@@ -355,6 +355,8 @@ load_b:
66+
67+
if (skb_is_nonlinear(skb))
68+
return 0;
69+
+ if (skb->len < sizeof(struct nlattr))
70+
+ return 0;
71+
if (A > skb->len - sizeof(struct nlattr))
72+
return 0;
73+
74+
@@ -371,11 +373,13 @@ load_b:
75+
76+
if (skb_is_nonlinear(skb))
77+
return 0;
78+
+ if (skb->len < sizeof(struct nlattr))
79+
+ return 0;
80+
if (A > skb->len - sizeof(struct nlattr))
81+
return 0;
82+
83+
nla = (struct nlattr *)&skb->data[A];
84+
- if (nla->nla_len > A - skb->len)
85+
+ if (nla->nla_len > skb->len - A)
86+
return 0;
87+
88+
nla = nla_find_nested(nla, X);
89+
--
90+
cgit v1.1
91+

‎patches/3.10/CVE-2014-4323.patch

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
From 014fa8def84c62893fa016e873c12de1da498603 Mon Sep 17 00:00:00 2001
2+
From: raghavendra ambadas <rambad@codeaurora.org>
3+
Date: Mon, 6 Oct 2014 14:59:57 +0530
4+
Subject: msm: mdp: Validate input arguments from user space
5+
6+
Fully verify the input arguments from user client are safe
7+
to use.
8+
9+
Change-Id: Ie14332443b187951009c63ebfb78456dcd9ba60f
10+
Signed-off-by: Raghavendra Ambadas <rambad@codeaurora.org>
11+
---
12+
drivers/video/msm/mdp.c | 5 +++++
13+
1 file changed, 5 insertions(+)
14+
15+
diff --git a/drivers/video/msm/mdp.c b/drivers/video/msm/mdp.c
16+
index 4ede0b52..c00bd78 100644
17+
--- a/drivers/video/msm/mdp.c
18+
+++ b/drivers/video/msm/mdp.c
19+
@@ -485,6 +485,11 @@ static int mdp_lut_hw_update(struct fb_cmap *cmap)
20+
c[1] = cmap->blue;
21+
c[2] = cmap->red;
22+
23+
+ if (cmap->start > MDP_HIST_LUT_SIZE || cmap->len > MDP_HIST_LUT_SIZE ||
24+
+ (cmap->start + cmap->len > MDP_HIST_LUT_SIZE)) {
25+
+ pr_err("mdp_lut_hw_update invalid arguments\n");
26+
+ return -EINVAL;
27+
+ }
28+
for (i = 0; i < cmap->len; i++) {
29+
if (copy_from_user(&r, cmap->red++, sizeof(r)) ||
30+
copy_from_user(&g, cmap->green++, sizeof(g)) ||
31+
--
32+
cgit v1.1
33+

0 commit comments

Comments
 (0)