[kernel] r14569 - in dists/etch-security/linux-2.6/debian: . patches/bugfix/all patches/series

[Dann Frazier]

Author: dannf
Date: Thu Nov  5 02:33:41 2009
New Revision: 14569

Log:
net ax25: Fix signed comparison in the sockopt handler (CVE-2009-2909)

Added:
   dists/etch-security/linux-2.6/debian/patches/bugfix/all/net-ax25-fix-signed-comparison-in-the-sockopt-handler.patch
      - copied unchanged from r14564, dists/etch-security/linux-2.6.24/debian/patches/bugfix/all/net-ax25-fix-signed-comparison-in-the-sockopt-handler.patch
Modified:
   dists/etch-security/linux-2.6/debian/changelog
   dists/etch-security/linux-2.6/debian/patches/series/26etch1

Modified: dists/etch-security/linux-2.6/debian/changelog
==============================================================================
--- dists/etch-security/linux-2.6/debian/changelog	Thu Nov  5 02:17:06 2009	(r14568)
+++ dists/etch-security/linux-2.6/debian/changelog	Thu Nov  5 02:33:41 2009	(r14569)
@@ -1,6 +1,7 @@
 linux-2.6 (2.6.18.dfsg.1-26etch1) UNRELEASED; urgency=high
 
   * [s390] Fix missing capability check in z90crypt driver (CVE-2009-1883)
+  * net ax25: Fix signed comparison in the sockopt handler (CVE-2009-2909)
 
  -- dann frazier <dannf at debian.org>  Tue, 15 Sep 2009 22:19:58 -0600
 

Copied: dists/etch-security/linux-2.6/debian/patches/bugfix/all/net-ax25-fix-signed-comparison-in-the-sockopt-handler.patch (from r14564, dists/etch-security/linux-2.6.24/debian/patches/bugfix/all/net-ax25-fix-signed-comparison-in-the-sockopt-handler.patch)
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ dists/etch-security/linux-2.6/debian/patches/bugfix/all/net-ax25-fix-signed-comparison-in-the-sockopt-handler.patch	Thu Nov  5 02:33:41 2009	(r14569, copy of r14564, dists/etch-security/linux-2.6.24/debian/patches/bugfix/all/net-ax25-fix-signed-comparison-in-the-sockopt-handler.patch)
@@ -0,0 +1,54 @@
+From arjan at infradead.org  Thu Oct  1 11:19:55 2009
+From: Arjan van de Ven <arjan at infradead.org>
+Date: Wed, 30 Sep 2009 13:51:11 +0200
+Subject: net ax25: Fix signed comparison in the sockopt handler
+To: davem at davemloft.net
+Cc: jakub at redhat.com, torvalds at linux-foundation.org, mingo at elte.hu, stable at kernel.org
+Message-ID: <20090930135111.64240d86 at infradead.org>
+
+
+From: Arjan van de Ven <arjan at linux.intel.com>
+
+fixed upstream in commit b7058842c940ad2c08dd829b21e5c92ebe3b8758 in a different way
+
+The ax25 code tried to use
+
+        if (optlen < sizeof(int))
+                return -EINVAL;
+
+as a security check against optlen being negative (or zero) in the
+set socket option.
+
+Unfortunately, "sizeof(int)" is an unsigned property, with the
+result that the whole comparison is done in unsigned, letting
+negative values slip through.
+
+This patch changes this to
+
+        if (optlen < (int)sizeof(int))
+                return -EINVAL;
+
+so that the comparison is done as signed, and negative values
+get properly caught.
+
+Signed-off-by: Arjan van de Ven <arjan at linux.intel.com>
+Cc: David S. Miller <davem at davemloft.net>
+Cc: Ingo Molnar <mingo at elte.hu>
+Cc: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+
+---
+ net/ax25/af_ax25.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -538,7 +538,7 @@ static int ax25_setsockopt(struct socket
+ 	if (level != SOL_AX25)
+ 		return -ENOPROTOOPT;
+ 
+-	if (optlen < sizeof(int))
++	if (optlen < (int)sizeof(int))
+ 		return -EINVAL;
+ 
+ 	if (get_user(opt, (int __user *)optval))

Modified: dists/etch-security/linux-2.6/debian/patches/series/26etch1
==============================================================================
--- dists/etch-security/linux-2.6/debian/patches/series/26etch1	Thu Nov  5 02:17:06 2009	(r14568)
+++ dists/etch-security/linux-2.6/debian/patches/series/26etch1	Thu Nov  5 02:33:41 2009	(r14569)
@@ -1 +1,2 @@
 + bugfix/s390/z90crypt-missing-cap-check.patch
++ bugfix/all/net-ax25-fix-signed-comparison-in-the-sockopt-handler.patch