[kernel] r11593 - in dists/etch/linux-2.6.24/debian: . patches/bugfix patches/series

[Dann Frazier]

Author: dannf
Date: Mon Jun  9 22:31:47 2008
New Revision: 11593

Log:
* Add sanity checks in ASN.1 decoding code (CVE-2008-1673)

Added:
   dists/etch/linux-2.6.24/debian/patches/bugfix/asn1-ber-decoding-checks.patch
Modified:
   dists/etch/linux-2.6.24/debian/changelog
   dists/etch/linux-2.6.24/debian/patches/series/6~etchnhalf.3

Modified: dists/etch/linux-2.6.24/debian/changelog
==============================================================================
--- dists/etch/linux-2.6.24/debian/changelog	(original)
+++ dists/etch/linux-2.6.24/debian/changelog	Mon Jun  9 22:31:47 2008
@@ -9,8 +9,9 @@
   * Fix issue with blkdev_issue_flush() not detecting/passing EOPNOTSUPP back,
     (closes: #482943)
   * [sparc] Validate address ranges regardless of MAP_FIXED (CVE-2008-2137)
+  * Add sanity checks in ASN.1 decoding code (CVE-2008-1673)
 
- -- dann frazier <dannf at debian.org>  Mon, 09 Jun 2008 16:28:15 -0600
+ -- dann frazier <dannf at debian.org>  Mon, 09 Jun 2008 16:30:33 -0600
 
 linux-2.6.24 (2.6.24-6~etchnhalf.2) stable; urgency=low
 

Added: dists/etch/linux-2.6.24/debian/patches/bugfix/asn1-ber-decoding-checks.patch
==============================================================================
--- (empty file)
+++ dists/etch/linux-2.6.24/debian/patches/bugfix/asn1-ber-decoding-checks.patch	Mon Jun  9 22:31:47 2008
@@ -0,0 +1,103 @@
+From: Chris Wright <chrisw at sous-sol.org>
+Date: Wed, 4 Jun 2008 16:16:33 +0000 (-0700)
+Subject: asn1: additional sanity checking during BER decoding
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=ddb2c43594f22843e9f3153da151deaba1a834c5
+
+asn1: additional sanity checking during BER decoding
+
+- Don't trust a length which is greater than the working buffer.
+  An invalid length could cause overflow when calculating buffer size
+  for decoding oid.
+
+- An oid length of zero is invalid and allows for an off-by-one error when
+  decoding oid because the first subid actually encodes first 2 subids.
+
+- A primitive encoding may not have an indefinite length.
+
+Thanks to Wei Wang from McAfee for report.
+
+Cc: Steven French <sfrench at us.ibm.com>
+Cc: stable at kernel.org
+Acked-by: Patrick McHardy <kaber at trash.net>
+Signed-off-by: Chris Wright <chrisw at sous-sol.org>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+---
+
+diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
+index cb52cbb..f58e41d 100644
+--- a/fs/cifs/asn1.c
++++ b/fs/cifs/asn1.c
+@@ -186,6 +186,11 @@ asn1_length_decode(struct asn1_ctx *ctx, unsigned int *def, unsigned int *len)
+ 			}
+ 		}
+ 	}
++
++	/* don't trust len bigger than ctx buffer */
++	if (*len > ctx->end - ctx->pointer)
++		return 0;
++
+ 	return 1;
+ }
+ 
+@@ -203,6 +208,10 @@ asn1_header_decode(struct asn1_ctx *ctx,
+ 	if (!asn1_length_decode(ctx, &def, &len))
+ 		return 0;
+ 
++	/* primitive shall be definite, indefinite shall be constructed */
++	if (*con == ASN1_PRI && !def)
++		return 0;
++
+ 	if (def)
+ 		*eoc = ctx->pointer + len;
+ 	else
+@@ -389,6 +398,11 @@ asn1_oid_decode(struct asn1_ctx *ctx,
+ 	unsigned long *optr;
+ 
+ 	size = eoc - ctx->pointer + 1;
++
++	/* first subid actually encodes first two subids */
++	if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))
++		return 0;
++
+ 	*oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC);
+ 	if (*oid == NULL)
+ 		return 0;
+diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
+index 5daefad..7750c97 100644
+--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
++++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
+@@ -232,6 +232,11 @@ static unsigned char asn1_length_decode(struct asn1_ctx *ctx,
+ 			}
+ 		}
+ 	}
++
++	/* don't trust len bigger than ctx buffer */
++	if (*len > ctx->end - ctx->pointer)
++		return 0;
++
+ 	return 1;
+ }
+ 
+@@ -250,6 +255,10 @@ static unsigned char asn1_header_decode(struct asn1_ctx *ctx,
+ 	if (!asn1_length_decode(ctx, &def, &len))
+ 		return 0;
+ 
++	/* primitive shall be definite, indefinite shall be constructed */
++	if (*con == ASN1_PRI && !def)
++		return 0;
++
+ 	if (def)
+ 		*eoc = ctx->pointer + len;
+ 	else
+@@ -434,6 +443,11 @@ static unsigned char asn1_oid_decode(struct asn1_ctx *ctx,
+ 	unsigned long *optr;
+ 
+ 	size = eoc - ctx->pointer + 1;
++
++	/* first subid actually encodes first two subids */
++	if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))
++		return 0;
++
+ 	*oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC);
+ 	if (*oid == NULL) {
+ 		if (net_ratelimit())

Modified: dists/etch/linux-2.6.24/debian/patches/series/6~etchnhalf.3
==============================================================================
--- dists/etch/linux-2.6.24/debian/patches/series/6~etchnhalf.3	(original)
+++ dists/etch/linux-2.6.24/debian/patches/series/6~etchnhalf.3	Mon Jun  9 22:31:47 2008
@@ -4,3 +4,4 @@
 + bugfix/block-fix-blkdev_issue_flush.patch
 + bugfix/sparc-fix-mmap-va-span-checking.patch
 + bugfix/sparc-fix-mremap-addr-range-validation.patch
++ bugfix/asn1-ber-decoding-checks.patch