projects / platform / kernel / linux-3.10.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: ac185bd) | patch
Fix sctp privilege elevation (CVE-2006-3745)
authorSridhar Samudrala <sri@us.ibm.com>
Tue, 22 Aug 2006 18:50:39 +0000 (11:50 -0700)
committerGreg Kroah-Hartman <gregkh@suse.de>
Tue, 22 Aug 2006 19:52:23 +0000 (12:52 -0700)
commitc164a9ba0a8870c5c9d353f63085319931d69f23
tree7e315a50008d0310dd5572a62baef34ddba89988tree | snapshot
parentac185bdc02c216040f3b83f654d864bd8a29cedccommit | diff
Fix sctp privilege elevation (CVE-2006-3745)

sctp_make_abort_user() now takes the msg_len along with the msg
so that we don't have to recalculate the bytes in iovec.
It also uses memcpy_fromiovec() so that we don't go beyond the
length allocated.

It is good to have this fix even if verify_iovec() is fixed to
return error on overflow.

Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
include/net/sctp/sctp.h diff | blob | history
include/net/sctp/sm.h diff | blob | history
net/sctp/sm_make_chunk.c diff | blob | history
net/sctp/sm_statefuns.c diff | blob | history
net/sctp/socket.c diff | blob | history
Domain: System / Kernel;