Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 276bdb82 authored by Mathias Krause's avatar Mathias Krause Committed by David S. Miller
Browse files

dccp: check ccid before dereferencing 



ccid_hc_rx_getsockopt() and ccid_hc_tx_getsockopt() might be called with
a NULL ccid pointer leading to a NULL pointer dereference. This could
lead to a privilege escalation if the attacker is able to map page 0 and
prepare it with a fake ccid_ops pointer.

Signed-off-by: default avatarMathias Krause <minipli@googlemail.com>
Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 3592aaeb

net/dccp/ccid.h

+2 −2
Original line number Diff line number Diff line
@@ -246,7 +246,7 @@ static inline int ccid_hc_rx_getsockopt(struct ccid *ccid, struct sock *sk, 
					u32 __user *optval, int __user *optlen)

{

	int rc = -ENOPROTOOPT;

	if (ccid->ccid_ops->ccid_hc_rx_getsockopt != NULL)

	if (ccid != NULL && ccid->ccid_ops->ccid_hc_rx_getsockopt != NULL)

		rc = ccid->ccid_ops->ccid_hc_rx_getsockopt(sk, optname, len,

						 optval, optlen);

	return rc;
@@ -257,7 +257,7 @@ static inline int ccid_hc_tx_getsockopt(struct ccid *ccid, struct sock *sk, 
					u32 __user *optval, int __user *optlen)

{

	int rc = -ENOPROTOOPT;

	if (ccid->ccid_ops->ccid_hc_tx_getsockopt != NULL)

	if (ccid != NULL && ccid->ccid_ops->ccid_hc_tx_getsockopt != NULL)

		rc = ccid->ccid_ops->ccid_hc_tx_getsockopt(sk, optname, len,

						 optval, optlen);

	return rc;