[kernel] r9129 - in dists/sarge-security/kernel-2.4/source/kernel-source-2.4.27-2.4.27/debian: . patches patches/series

[Dann Frazier]

Author: dannf
Date: Fri Jul 13 05:47:42 2007
New Revision: 9129

Log:
* 246_dn_fib-out-of-bounds.diff
  See CVE-2007-2172

Added:
   dists/sarge-security/kernel-2.4/source/kernel-source-2.4.27-2.4.27/debian/patches/246_dn_fib-out-of-bounds.diff
Modified:
   dists/sarge-security/kernel-2.4/source/kernel-source-2.4.27-2.4.27/debian/changelog
   dists/sarge-security/kernel-2.4/source/kernel-source-2.4.27-2.4.27/debian/patches/series/2.4.27-10sarge6

Modified: dists/sarge-security/kernel-2.4/source/kernel-source-2.4.27-2.4.27/debian/changelog
==============================================================================
--- dists/sarge-security/kernel-2.4/source/kernel-source-2.4.27-2.4.27/debian/changelog	(original)
+++ dists/sarge-security/kernel-2.4/source/kernel-source-2.4.27-2.4.27/debian/changelog	Fri Jul 13 05:47:42 2007
@@ -23,8 +23,11 @@
     245_bluetooth-l2cap-hci-info-leaks-2.diff
     [SECURITY] Fix information leaks in setsockopt() implementations
     See CVE-2007-1353
+  * 246_dn_fib-out-of-bounds.diff
+    [SECURITY] Fix out of bounds condition in dn_fib_props[]
+    See CVE-2007-2172
 
- -- dann frazier <dannf at debian.org>  Wed, 06 Jun 2007 18:19:35 -0600
+ -- dann frazier <dannf at debian.org>  Thu, 12 Jul 2007 23:46:15 -0600
 
 kernel-source-2.4.27 (2.4.27-10sarge5) stable-security; urgency=high
 

Added: dists/sarge-security/kernel-2.4/source/kernel-source-2.4.27-2.4.27/debian/patches/246_dn_fib-out-of-bounds.diff
==============================================================================
--- (empty file)
+++ dists/sarge-security/kernel-2.4/source/kernel-source-2.4.27-2.4.27/debian/patches/246_dn_fib-out-of-bounds.diff	Fri Jul 13 05:47:42 2007
@@ -0,0 +1,38 @@
+commit a86164be2f5448d27c2ae9eaf69ce21ea2dec33d
+Author: Willy Tarreau <w at 1wt.eu>
+Date:   Sat Apr 14 17:39:47 2007 +0200
+
+    [DECNet] fib: Fix out of bound access of dn_fib_props[]
+    
+    Backported from 2.6. Found and fixed from Thomas Graf :
+    
+    Fixes a typo which caused fib_props[] to have the wrong size
+    and makes sure the value used to index the array which is
+    provided by userspace via netlink is checked to avoid out of
+    bound access.
+    
+    Signed-off-by: Thomas Graf <tgraf at suug.ch>
+
+diff --git a/net/decnet/dn_fib.c b/net/decnet/dn_fib.c
+index 59a1c9f..6c42818 100644
+--- a/net/decnet/dn_fib.c
++++ b/net/decnet/dn_fib.c
+@@ -61,7 +61,7 @@ static struct
+ {
+ 	int error;
+ 	u8 scope;
+-} dn_fib_props[RTA_MAX+1] = {
++} dn_fib_props[RTN_MAX+1] = {
+ 	{ 0, RT_SCOPE_NOWHERE },		/* RTN_UNSPEC */
+ 	{ 0, RT_SCOPE_UNIVERSE },		/* RTN_UNICAST */
+ 	{ 0, RT_SCOPE_HOST },			/* RTN_LOCAL */
+@@ -257,6 +257,9 @@ struct dn_fib_info *dn_fib_create_info(const struct rtmsg *r, struct dn_kern_rta
+ 	struct dn_fib_info *ofi;
+ 	int nhs = 1;
+ 
++	if (r->rtm_type > RTN_MAX)
++		goto err_inval;
++
+ 	if (dn_fib_props[r->rtm_type].scope > r->rtm_scope)
+ 		goto err_inval;
+ 

Modified: dists/sarge-security/kernel-2.4/source/kernel-source-2.4.27-2.4.27/debian/patches/series/2.4.27-10sarge6
==============================================================================
--- dists/sarge-security/kernel-2.4/source/kernel-source-2.4.27-2.4.27/debian/patches/series/2.4.27-10sarge6	(original)
+++ dists/sarge-security/kernel-2.4/source/kernel-source-2.4.27-2.4.27/debian/patches/series/2.4.27-10sarge6	Fri Jul 13 05:47:42 2007
@@ -5,3 +5,4 @@
 + 243_ipv6_fl_socklist-no-share.diff
 + 244_bluetooth-l2cap-hci-info-leaks.diff
 + 245_bluetooth-l2cap-hci-info-leaks-2.diff
++ 246_dn_fib-out-of-bounds.diff