[linux] 02/02: ipv4: keep skb->dst around in presence of IP options (CVE-2017-5970)

[debian-kernel at lists.debian.org]

This is an automated email from the git hooks/post-receive script.

benh pushed a commit to branch jessie-security
in repository linux.

commit 1abe2f09cd399e4c369240bca6520ef91857d6cc
Author: Ben Hutchings <ben at decadent.org.uk>
Date:   Tue Feb 21 19:42:21 2017 +0000

    ipv4: keep skb->dst around in presence of IP options (CVE-2017-5970)
---
 debian/changelog                                   |  1 +
 ...-skb-dst-around-in-presence-of-ip-options.patch | 43 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 3 files changed, 45 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index 52f66ce..4643090 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -19,6 +19,7 @@ linux (3.16.39-1+deb8u1) UNRELEASED; urgency=medium
   * tmpfs: clear S_ISGID when setting posix ACLs (CVE-2017-5551)
   * ip6_gre: fix ip6gre_err() invalid reads (CVE-2017-5897)
   * [x86] kvm: fix page struct leak in handle_vmon (CVE-2017-2596)
+  * ipv4: keep skb->dst around in presence of IP options (CVE-2017-5970)
 
  -- Salvatore Bonaccorso <carnil at debian.org>  Sat, 18 Feb 2017 18:26:58 +0100
 
diff --git a/debian/patches/bugfix/all/ipv4-keep-skb-dst-around-in-presence-of-ip-options.patch b/debian/patches/bugfix/all/ipv4-keep-skb-dst-around-in-presence-of-ip-options.patch
new file mode 100644
index 0000000..4233721
--- /dev/null
+++ b/debian/patches/bugfix/all/ipv4-keep-skb-dst-around-in-presence-of-ip-options.patch
@@ -0,0 +1,43 @@
+From: Eric Dumazet <edumazet at google.com>
+Date: Sat, 4 Feb 2017 11:16:52 -0800
+Subject: ipv4: keep skb->dst around in presence of IP options
+Origin: https://git.kernel.org/linus/34b2cef20f19c87999fff3da4071e66937db9644
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-5970
+
+Andrey Konovalov got crashes in __ip_options_echo() when a NULL skb->dst
+is accessed.
+
+ipv4_pktinfo_prepare() should not drop the dst if (evil) IP options
+are present.
+
+We could refine the test to the presence of ts_needtime or srr,
+but IP options are not often used, so let's be conservative.
+
+Thanks to syzkaller team for finding this bug.
+
+Fixes: d826eb14ecef ("ipv4: PKTINFO doesnt need dst reference")
+Signed-off-by: Eric Dumazet <edumazet at google.com>
+Reported-by: Andrey Konovalov <andreyknvl at google.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+---
+ net/ipv4/ip_sockglue.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/net/ipv4/ip_sockglue.c
++++ b/net/ipv4/ip_sockglue.c
+@@ -1079,7 +1079,14 @@ void ipv4_pktinfo_prepare(const struct s
+ 		pktinfo->ipi_ifindex = 0;
+ 		pktinfo->ipi_spec_dst.s_addr = 0;
+ 	}
+-	skb_dst_drop(skb);
++	/* We need to keep the dst for __ip_options_echo()
++	 * We could restrict the test to opt.ts_needtime || opt.srr,
++	 * but the following is good enough as IP options are not often used.
++	 */
++	if (unlikely(IPCB(skb)->opt.optlen))
++		skb_dst_force(skb);
++	else
++		skb_dst_drop(skb);
+ }
+ 
+ int ip_setsockopt(struct sock *sk, int level,
diff --git a/debian/patches/series b/debian/patches/series
index c613ea7..0446165 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -693,6 +693,7 @@ bugfix/all/usb-serial-kl5kusb105-fix-line-state-error-handling.patch
 bugfix/all/tmpfs-clear-s_isgid-when-setting-posix-acls.patch
 bugfix/all/ip6_gre-fix-ip6gre_err-invalid-reads.patch
 bugfix/x86/kvm-fix-page-struct-leak-in-handle_vmon.patch
+bugfix/all/ipv4-keep-skb-dst-around-in-presence-of-ip-options.patch
 
 # Fix ABI changes
 debian/of-fix-abi-changes.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git