udp: prevent bugcheck if filter truncates packet too much
authorMichal Kubeček <mkubecek@suse.cz>
Fri, 8 Jul 2016 15:52:33 +0000 (17:52 +0200)
committerDavid S. Miller <davem@davemloft.net>
Mon, 11 Jul 2016 19:43:15 +0000 (12:43 -0700)
commita612769774a30e4fc143c4cb6395c12573415660
tree6d8340d073fd7465158f130e1bbe23429956f3b0
parentf3ea3119ad75dde0ba3e8da4653dbd5a189688e5
udp: prevent bugcheck if filter truncates packet too much

If socket filter truncates an udp packet below the length of UDP header
in udpv6_queue_rcv_skb() or udp_queue_rcv_skb(), it will trigger a
BUG_ON in skb_pull_rcsum(). This BUG_ON (and therefore a system crash if
kernel is configured that way) can be easily enforced by an unprivileged
user which was reported as CVE-2016-6162. For a reproducer, see
http://seclists.org/oss-sec/2016/q3/8

Fixes: e6afc8ace6dd ("udp: remove headers from UDP packets before queueing")
Reported-by: Marco Grassi <marco.gra@gmail.com>
Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Acked-by: Eric Dumazet <edumazet@google.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/udp.c
net/ipv6/udp.c