Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 253ff030 authored by Dheeraj Kumar's avatar Dheeraj Kumar
Browse files

MobileAP: CVE-2022-2663 fix revert kernel change 



Added CVE-2022-2663 fix revert kernel change

Change-Id: I0230a6bc4fd3903c918bce86a5e5728c044b3e3b
Signed-off-by: default avatarDheeraj Kumar <quic_dhekum@quicinc.com>
parent e602774f

net/netfilter/nf_conntrack_irc.c

+32 −8
Original line number Diff line number Diff line
@@ -435,15 +435,38 @@ static int help(struct sk_buff *skb, unsigned int protoff, 
		 * 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14

		 */

		data = ib_ptr;

		while (data < data_limit - (19 + MINMATCHLEN)) {

			if (memcmp(data, "\1DCC ", 5)) {

		/* Skip any whitespace */

		while (data < data_limit - 10) {

			if (*data == ' ' || *data == '\r' || *data == '\n')

				data++;

			else

				break;

		}



		/* strlen("PRIVMSG x ")=10 */

		if (data < data_limit - 10) {

			if (strncasecmp("PRIVMSG ", data, 8))

				goto out;

			data += 8;

		}



		/* strlen(" :\1DCC SENT t AAAAAAAA P\1\n")=26

		 * 7+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=26

		 */

		while (data < data_limit - (21 + MINMATCHLEN)) {

			/* Find first " :", the start of message */

			if (memcmp(data, " :", 2)) {

				data++;

				continue;

			}

			data += 2;



			/* then check that place only for the DCC command */

			if (memcmp(data, "\1DCC ", 5))

				goto out;

			data += 5;

			/* we have at least (19+MINMATCHLEN)-5

			 *bytes valid data left

			 */

			/* we have at least (21+MINMATCHLEN)-(2+5) bytes valid data left */



			iph = ip_hdr(skb);

			pr_debug("DCC found in master %pI4:%u %pI4:%u\n",

				 &iph->saddr, ntohs(th->source),
@@ -459,7 +482,7 @@ static int help(struct sk_buff *skb, unsigned int protoff, 
				pr_debug("DCC %s detected\n", dccprotos[i]);



				/* we have at least

				 * (19+MINMATCHLEN)-5-dccprotos[i].matchlen

				 * (21+MINMATCHLEN)-7-dccprotos[i].matchlen

				 *bytes valid data left (== 14/13 bytes)

				 */

				if (parse_dcc(data, data_limit, &dcc_ip,
@@ -476,8 +499,9 @@ static int help(struct sk_buff *skb, unsigned int protoff, 
				 *external (NAT'ed) IP

				 */

				tuple = &ct->tuplehash[dir].tuple;

				if (tuple->src.u3.ip != dcc_ip &&

				    tuple->dst.u3.ip != dcc_ip) {

				if ((tuple->src.u3.ip != dcc_ip &&

				     ct->tuplehash[!dir].tuple.dst.u3.ip != dcc_ip) ||

				    dcc_port == 0) {

					net_warn_ratelimited("Forged DCC command from %pI4: %pI4:%u\n",

							     &tuple->src.u3.ip,

							     &dcc_ip, dcc_port);