[linux] 02/02: tcp: fix use after free in tcp_xmit_retransmit_queue() (CVE-2016-6828)

[debian-kernel at lists.debian.org]

This is an automated email from the git hooks/post-receive script.

carnil pushed a commit to branch jessie-security
in repository linux.

commit 121b60af11646210937eba34dfadb30f04f96fb5
Author: Salvatore Bonaccorso <carnil at debian.org>
Date:   Tue Aug 30 11:19:15 2016 +0200

    tcp: fix use after free in tcp_xmit_retransmit_queue() (CVE-2016-6828)
---
 debian/changelog                                   |  4 ++
 ...e-after-free-in-tcp_xmit_retransmit_queue.patch | 50 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 3 files changed, 55 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index 84a3388..9f1d6f8 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,8 +1,12 @@
 linux (3.16.36-1+deb8u1) UNRELEASED; urgency=medium
 
+  [ Ben Hutchings ]
   * tcp: make challenge acks less predictable (CVE-2016-5696)
   * audit: fix a double fetch in audit_log_single_execve_arg() (CVE-2016-6136)
 
+  [ Salvatore Bonaccorso ]
+  * tcp: fix use after free in tcp_xmit_retransmit_queue() (CVE-2016-6828)
+
  -- Ben Hutchings <ben at decadent.org.uk>  Fri, 12 Aug 2016 16:16:03 +0100
 
 linux (3.16.36-1) jessie; urgency=medium
diff --git a/debian/patches/bugfix/all/tcp-fix-use-after-free-in-tcp_xmit_retransmit_queue.patch b/debian/patches/bugfix/all/tcp-fix-use-after-free-in-tcp_xmit_retransmit_queue.patch
new file mode 100644
index 0000000..9b64443
--- /dev/null
+++ b/debian/patches/bugfix/all/tcp-fix-use-after-free-in-tcp_xmit_retransmit_queue.patch
@@ -0,0 +1,50 @@
+From: Eric Dumazet <edumazet at google.com>
+Date: Wed, 17 Aug 2016 05:56:26 -0700
+Subject: tcp: fix use after free in tcp_xmit_retransmit_queue()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Origin: https://git.kernel.org/linus/bb1fceca22492109be12640d49f5ea5a544c6bb4
+
+When tcp_sendmsg() allocates a fresh and empty skb, it puts it at the
+tail of the write queue using tcp_add_write_queue_tail()
+
+Then it attempts to copy user data into this fresh skb.
+
+If the copy fails, we undo the work and remove the fresh skb.
+
+Unfortunately, this undo lacks the change done to tp->highest_sack and
+we can leave a dangling pointer (to a freed skb)
+
+Later, tcp_xmit_retransmit_queue() can dereference this pointer and
+access freed memory. For regular kernels where memory is not unmapped,
+this might cause SACK bugs because tcp_highest_sack_seq() is buggy,
+returning garbage instead of tp->snd_nxt, but with various debug
+features like CONFIG_DEBUG_PAGEALLOC, this can crash the kernel.
+
+This bug was found by Marco Grassi thanks to syzkaller.
+
+Fixes: 6859d49475d4 ("[TCP]: Abstract tp->highest_sack accessing & point to next skb")
+Reported-by: Marco Grassi <marco.gra at gmail.com>
+Signed-off-by: Eric Dumazet <edumazet at google.com>
+Cc: Ilpo Järvinen <ilpo.jarvinen at helsinki.fi>
+Cc: Yuchung Cheng <ycheng at google.com>
+Cc: Neal Cardwell <ncardwell at google.com>
+Acked-by: Neal Cardwell <ncardwell at google.com>
+Reviewed-by: Cong Wang <xiyou.wangcong at gmail.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+---
+ include/net/tcp.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1413,6 +1413,8 @@ static inline void tcp_check_send_head(s
+ {
+ 	if (sk->sk_send_head == skb_unlinked)
+ 		sk->sk_send_head = NULL;
++	if (tcp_sk(sk)->highest_sack == skb_unlinked)
++		tcp_sk(sk)->highest_sack = NULL;
+ }
+ 
+ static inline void tcp_init_send_head(struct sock *sk)
diff --git a/debian/patches/series b/debian/patches/series
index 26a89b2..7f899b0 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -675,6 +675,7 @@ bugfix/all/hid-hiddev-validate-num_values-for-hidiocgusages-hid.patch
 bugfix/s390/s390-sclp_ctl-fix-potential-information-leak-with-de.patch
 bugfix/all/tcp-make-challenge-acks-less-predictable.patch
 bugfix/all/audit-fix-a-double-fetch-in-audit_log_single_execve_arg.patch
+bugfix/all/tcp-fix-use-after-free-in-tcp_xmit_retransmit_queue.patch
 
 # Fix ABI changes
 debian/of-fix-abi-changes.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git