Messages in this thread | | | Subject | Re: [PATCH net v3] tipc: check minimum bearer MTU | From | Ying Xue <> | Date | Fri, 2 Dec 2016 20:07:15 +0800 |
| |
On 12/02/2016 04:33 PM, Michal Kubecek wrote: > Qian Zhang (张谦) reported a potential socket buffer overflow in > tipc_msg_build() which is also known as CVE-2016-8632: due to > insufficient checks, a buffer overflow can occur if MTU is too short for > even tipc headers. As anyone can set device MTU in a user/net namespace, > this issue can be abused by a regular user. > > As agreed in the discussion on Ben Hutchings' original patch, we should > check the MTU at the moment a bearer is attached rather than for each > processed packet. We also need to repeat the check when bearer MTU is > adjusted to new device MTU. UDP case also needs a check to avoid > overflow when calculating bearer MTU. > > Fixes: b97bf3fd8f6a ("[TIPC] Initial merge") > Signed-off-by: Michal Kubecek <mkubecek@suse.cz> > Reported-by: Qian Zhang (张谦) <zhangqian-c@360.cn> > ---
Thanks, it looks nice to me.
Acked-by: Ying Xue <ying.xue@windriver.com>
| |