/[pkg-src]/trunk/kernel26-magellan/patches-2.6.16-r12/0134-2.6.16.19-netfilter-fix-information-leak-in-SO_ORIGINAL_DST.patch |
Annotation of /trunk/kernel26-magellan/patches-2.6.16-r12/0134-2.6.16.19-netfilter-fix-information-leak-in-SO_ORIGINAL_DST.patch
Parent Directory | Revision Log
Revision 72 -
(hide annotations)
(download)
Mon Jun 5 09:25:38 2006 UTC (18 years, 3 months ago) by niro
File size: 1523 byte(s)
Mon Jun 5 09:25:38 2006 UTC (18 years, 3 months ago) by niro
File size: 1523 byte(s)
ver bump to 2.6.16-r12: - updated to linux-2.6.16.19 - updated to ck11
1 | niro | 72 | From: Marcel Holtmann <marcel@holtmann.org> |
2 | Date: Fri, 26 May 2006 11:50:46 +0000 (+0200) | ||
3 | Subject: [PATCH] NETFILTER: Fix small information leak in SO_ORIGINAL_DST (CVE-2006-1343) | ||
4 | X-Git-Url: http://www.kernel.org/git/?p=linux/kernel/git/stable/linux-2.6.16.y.git;a=commitdiff;h=11091f6a4a11feb5794aef9307c428838129ea02 | ||
5 | |||
6 | [PATCH] NETFILTER: Fix small information leak in SO_ORIGINAL_DST (CVE-2006-1343) | ||
7 | |||
8 | It appears that sockaddr_in.sin_zero is not zeroed during | ||
9 | getsockopt(...SO_ORIGINAL_DST...) operation. This can lead | ||
10 | to an information leak (CVE-2006-1343). | ||
11 | |||
12 | Signed-off-by: Marcel Holtmann <marcel@holtmann.org> | ||
13 | Signed-off-by: Chris Wright <chrisw@sous-sol.org> | ||
14 | --- | ||
15 | |||
16 | --- a/net/ipv4/netfilter/ip_conntrack_core.c | ||
17 | +++ b/net/ipv4/netfilter/ip_conntrack_core.c | ||
18 | @@ -1318,6 +1318,7 @@ getorigdst(struct sock *sk, int optval, | ||
19 | .tuple.dst.u.tcp.port; | ||
20 | sin.sin_addr.s_addr = ct->tuplehash[IP_CT_DIR_ORIGINAL] | ||
21 | .tuple.dst.ip; | ||
22 | + memset(sin.sin_zero, 0, sizeof(sin.sin_zero)); | ||
23 | |||
24 | DEBUGP("SO_ORIGINAL_DST: %u.%u.%u.%u %u\n", | ||
25 | NIPQUAD(sin.sin_addr.s_addr), ntohs(sin.sin_port)); | ||
26 | --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | ||
27 | +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | ||
28 | @@ -354,6 +354,7 @@ getorigdst(struct sock *sk, int optval, | ||
29 | .tuple.dst.u.tcp.port; | ||
30 | sin.sin_addr.s_addr = ct->tuplehash[IP_CT_DIR_ORIGINAL] | ||
31 | .tuple.dst.u3.ip; | ||
32 | + memset(sin.sin_zero, 0, sizeof(sin.sin_zero)); | ||
33 | |||
34 | DEBUGP("SO_ORIGINAL_DST: %u.%u.%u.%u %u\n", | ||
35 | NIPQUAD(sin.sin_addr.s_addr), ntohs(sin.sin_port)); |