netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 0/2] net: dccp: fix structure use-after-free
@ 2020-10-13 17:18 Kleber Sacilotto de Souza
  2020-10-13 17:18 ` [PATCH 1/2] dccp: ccid: move timers to struct dccp_sock Kleber Sacilotto de Souza
  2020-10-13 17:18 ` [PATCH 2/2] Revert "dccp: don't free ccid2_hc_tx_sock struct in dccp_disconnect()" Kleber Sacilotto de Souza
  0 siblings, 2 replies; 18+ messages in thread
From: Kleber Sacilotto de Souza @ 2020-10-13 17:18 UTC (permalink / raw)
  To: netdev
  Cc: Gerrit Renker, David S. Miller, Jakub Kicinski,
	Thadeu Lima de Souza Cascardo, Gustavo A. R. Silva,
	Alexander A. Klimov, Kees Cook, Eric Dumazet, Alexey Kodanev,
	dccp, linux-kernel

This patchset addresses the following CVE:

CVE-2020-16119 - DCCP CCID structure use-after-free

Hadar Manor reported that by reusing a socket with an attached
dccps_hc_tx_ccid as a listener, it will be used after being released,
leading to DoS and potentially code execution.

The first patch moves the ccid timers to struct dccp_sock to avoid its
use-after-free, the second patch reverts 2677d2067731 "dccp: don't free
ccid2_hc_tx_sock struct in dccp_disconnect()" that's not needed anymore
and would cause another use-after-free.

Thadeu Lima de Souza Cascardo (2):
  dccp: ccid: move timers to struct dccp_sock
  Revert "dccp: don't free ccid2_hc_tx_sock struct in dccp_disconnect()"

 include/linux/dccp.h   |  2 ++
 net/dccp/ccids/ccid2.c | 32 +++++++++++++++++++-------------
 net/dccp/ccids/ccid3.c | 30 ++++++++++++++++++++----------
 net/dccp/proto.c       |  2 ++
 4 files changed, 43 insertions(+), 23 deletions(-)

-- 
2.25.1


^ permalink raw reply	[flat|nested] 18+ messages in thread

end of thread, other threads:[~2020-11-10 16:17 UTC | newest]

Thread overview: 18+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-13 17:18 [PATCH 0/2] net: dccp: fix structure use-after-free Kleber Sacilotto de Souza
2020-10-13 17:18 ` [PATCH 1/2] dccp: ccid: move timers to struct dccp_sock Kleber Sacilotto de Souza
2020-10-13 18:58   ` Richard Sailer
2020-10-15  3:43   ` Jakub Kicinski
2020-10-15 10:53     ` Thadeu Lima de Souza Cascardo
2020-10-16 22:30   ` Jakub Kicinski
2020-11-09 11:48     ` Thadeu Lima de Souza Cascardo
2020-11-09 17:49       ` Jakub Kicinski
2020-11-09 21:09         ` Thadeu Lima de Souza Cascardo
2020-11-09 21:15           ` Jakub Kicinski
2020-11-09 21:31             ` Thadeu Lima de Souza Cascardo
2020-11-09 22:15               ` Jakub Kicinski
2020-11-10 11:19                 ` Thadeu Lima de Souza Cascardo
2020-11-10 16:16                   ` Jakub Kicinski
2020-10-13 17:18 ` [PATCH 2/2] Revert "dccp: don't free ccid2_hc_tx_sock struct in dccp_disconnect()" Kleber Sacilotto de Souza
2020-10-13 18:59   ` Richard Sailer
2020-10-15  3:42   ` Jakub Kicinski
2020-10-15  9:23     ` Kleber Souza

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).