acrn-kernel/net/ipv6/netfilter
Solar Designer 2c8ac66bb2 [NETFILTER]: Fix do_add_counters race, possible oops or info leak (CVE-2006-0039)
Solar Designer found a race condition in do_add_counters(). The beginning
of paddc is supposed to be the same as tmp which was sanity-checked
above, but it might not be the same in reality. In case the integer
overflow and/or the race condition are triggered, paddc->num_counters
might not match the allocation size for paddc. If the check below
(t->private->number != paddc->num_counters) nevertheless passes (perhaps
this requires the race condition to be triggered), IPT_ENTRY_ITERATE()
would read kernel memory beyond the allocation size, potentially causing
an oops or leaking sensitive data (e.g., passwords from host system or
from another VPS) via counter increments. This requires CAP_NET_ADMIN.

Signed-off-by: Solar Designer <solar@openwall.com>
Signed-off-by: Kirill Korotaev <dev@openvz.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-05-19 02:16:52 -07:00
..
Kconfig [NETFILTER]: x_tables: unify IPv4/IPv6 multiport match 2006-04-01 02:22:54 -08:00
Makefile [NETFILTER]: x_tables: unify IPv4/IPv6 multiport match 2006-04-01 02:22:54 -08:00
ip6_queue.c [NETFILTER]: Fix section mismatch warnings 2006-04-09 22:25:34 -07:00
ip6_tables.c [NETFILTER]: Fix do_add_counters race, possible oops or info leak (CVE-2006-0039) 2006-05-19 02:16:52 -07:00
ip6t_HL.c [NETFILTER]: Rename init functions. 2006-03-28 17:02:48 -08:00
ip6t_LOG.c [NETFILTER]: fix format specifier for netfilter log targets 2006-05-19 02:15:47 -07:00
ip6t_REJECT.c [NETFILTER]: Rename init functions. 2006-03-28 17:02:48 -08:00
ip6t_ah.c [NETFILTER]: Rename init functions. 2006-03-28 17:02:48 -08:00
ip6t_dst.c [NETFILTER]: Rename init functions. 2006-03-28 17:02:48 -08:00
ip6t_eui64.c [IPV6]: Endian fix in net/ipv6/netfilter/ip6t_eui64.c:match(). 2006-05-16 15:24:41 -07:00
ip6t_frag.c [NETFILTER]: Rename init functions. 2006-03-28 17:02:48 -08:00
ip6t_hbh.c [NETFILTER]: Rename init functions. 2006-03-28 17:02:48 -08:00
ip6t_hl.c [NETFILTER]: Rename init functions. 2006-03-28 17:02:48 -08:00
ip6t_ipv6header.c [NETFILTER]: x_tables: add xt_{match,target} arguments to match/target functions 2006-03-20 18:02:56 -08:00
ip6t_owner.c [NETFILTER]: Rename init functions. 2006-03-28 17:02:48 -08:00
ip6t_rt.c [NETFILTER]: Rename init functions. 2006-03-28 17:02:48 -08:00
ip6table_filter.c [NETFILTER]: Clean up hook registration 2006-04-09 22:25:33 -07:00
ip6table_mangle.c [NETFILTER]: Clean up hook registration 2006-04-09 22:25:33 -07:00
ip6table_raw.c [NETFILTER]: Clean up hook registration 2006-04-09 22:25:33 -07:00
nf_conntrack_l3proto_ipv6.c [NETFILTER]: Fix section mismatch warnings 2006-04-09 22:25:34 -07:00
nf_conntrack_proto_icmpv6.c [NETFILTER]: Convert conntrack/ipt_REJECT to new checksumming functions 2006-04-09 22:25:42 -07:00
nf_conntrack_reasm.c [NETFILTER]: nf_conntrack: use ipv6_addr_equal in nf_ct_reasm 2006-03-20 17:58:44 -08:00