Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e17df688 authored by Patrick McHardy's avatar Patrick McHardy Committed by Linus Torvalds
Browse files

[NETFILTER] SCTP conntrack: fix infinite loop 



fix infinite loop in the SCTP-netfilter code: check SCTP chunk size to
guarantee progress of for_each_sctp_chunk(). (all other uses of
for_each_sctp_chunk() are preceded by do_basic_checks(), so this fix
should be complete.)

Based on patch from Ingo Molnar <mingo@elte.hu>

CVE-2006-1527

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent ebf34c9b

net/ipv4/netfilter/ip_conntrack_proto_sctp.c

+7 −4
Original line number Diff line number Diff line
@@ -235,12 +235,15 @@ static int do_basic_checks(struct ip_conntrack *conntrack, 
			flag = 1;

		}



		/* Cookie Ack/Echo chunks not the first OR 

		   Init / Init Ack / Shutdown compl chunks not the only chunks */

		if ((sch->type == SCTP_CID_COOKIE_ACK 

		/*

		 * Cookie Ack/Echo chunks not the first OR

		 * Init / Init Ack / Shutdown compl chunks not the only chunks

		 * OR zero-length.

		 */

		if (((sch->type == SCTP_CID_COOKIE_ACK

			|| sch->type == SCTP_CID_COOKIE_ECHO

			|| flag)

		     && count !=0 ) {

		      && count !=0) || !sch->length) {

			DEBUGP("Basic checks failed\n");

			return 1;

		}

net/netfilter/nf_conntrack_proto_sctp.c

+7 −4
Original line number Diff line number Diff line
@@ -240,12 +240,15 @@ static int do_basic_checks(struct nf_conn *conntrack, 
			flag = 1;

		}



		/* Cookie Ack/Echo chunks not the first OR 

		   Init / Init Ack / Shutdown compl chunks not the only chunks */

		if ((sch->type == SCTP_CID_COOKIE_ACK 

		/*

		 * Cookie Ack/Echo chunks not the first OR

		 * Init / Init Ack / Shutdown compl chunks not the only chunks

		 * OR zero-length.

		 */

		if (((sch->type == SCTP_CID_COOKIE_ACK

			|| sch->type == SCTP_CID_COOKIE_ECHO

			|| flag)

		     && count !=0 ) {

		      && count !=0) || !sch->length) {

			DEBUGP("Basic checks failed\n");

			return 1;

		}