d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix SCTP SCTP_SS_VALUE kernel memory corruption and disclosure vulnerability.

Browse Source 
We would like to acknowledge Clement LECIGNE from Google Security Team and
Francisco Falcon from Core Security Technologies who discovered the issue
independently and reported to the FreeBSD Security Team.

Security:	FreeBSD-SA-15:02.kmem
Security:	CVE-2014-8612
Submitted by:	tuexen
This commit is contained in:
Xin LI 2015-01-27 19:35:36 +00:00
parent fc04dce059
commit 38f2a43815
1 changed files with 12 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
sys/netinet/sctp_usrreq.c
View File

@ -1863,8 +1863,9 @@ sctp_getopt(struct socket *so, int optname, void *optval, size_t *optsize,
SCTP_CHECK_AND_CAST(av, optval, struct sctp_stream_value, *optsize);
SCTP_FIND_STCB(inp, stcb, av->assoc_id);
if (stcb) {
if (stcb->asoc.ss_functions.sctp_ss_get_value(stcb, &stcb->asoc, &stcb->asoc.strmout[av->stream_id],
&av->stream_value) < 0) {
if ((av->stream_id >= stcb->asoc.streamoutcnt) ||
(stcb->asoc.ss_functions.sctp_ss_get_value(stcb, &stcb->asoc, &stcb->asoc.strmout[av->stream_id],
&av->stream_value) < 0)) {
SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_USRREQ, EINVAL);
error = EINVAL;
} else {
@ -4032,8 +4033,9 @@ sctp_setopt(struct socket *so, int optname, void *optval, size_t optsize,
SCTP_CHECK_AND_CAST(av, optval, struct sctp_stream_value, optsize);
SCTP_FIND_STCB(inp, stcb, av->assoc_id);
if (stcb) {
if (stcb->asoc.ss_functions.sctp_ss_set_value(stcb, &stcb->asoc, &stcb->asoc.strmout[av->stream_id],
av->stream_value) < 0) {
if ((av->stream_id >= stcb->asoc.streamoutcnt) ||
(stcb->asoc.ss_functions.sctp_ss_set_value(stcb, &stcb->asoc, &stcb->asoc.strmout[av->stream_id],
av->stream_value) < 0)) {
SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_USRREQ, EINVAL);
error = EINVAL;
}
@ -4043,10 +4045,12 @@ sctp_setopt(struct socket *so, int optname, void *optval, size_t optsize,
SCTP_INP_RLOCK(inp);
LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
SCTP_TCB_LOCK(stcb);
stcb->asoc.ss_functions.sctp_ss_set_value(stcb,
&stcb->asoc,
&stcb->asoc.strmout[av->stream_id],
av->stream_value);
if (av->stream_id < stcb->asoc.streamoutcnt) {
stcb->asoc.ss_functions.sctp_ss_set_value(stcb,
&stcb->asoc,
&stcb->asoc.strmout[av->stream_id],
av->stream_value);
}
SCTP_TCB_UNLOCK(stcb);
}
SCTP_INP_RUNLOCK(inp);