Git-Url:
http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-current.git;a=commitdiff;h=5eac2ec0f460f2d08eb96c426317be92acb0b6ef
commit 5eac2ec0f460f2d08eb96c426317be92acb0b6ef
Author: Miklos Vajna <[EMAIL PROTECTED]>
Date: Sat Jun 21 00:32:38 2008 +0200
kernel-2.6.25-6-i686
- no release bump yet
- update to patchlevel '.7'
- added CVE-2008-2750.patch
- closes #3173
diff --git a/source/base/kernel/CVE-2008-2750.patch
b/source/base/kernel/CVE-2008-2750.patch
new file mode 100644
index 0000000..1238d11
--- /dev/null
+++ b/source/base/kernel/CVE-2008-2750.patch
@@ -0,0 +1,56 @@
+From 6b6707a50c7598a83820077393f8823ab791abf8 Mon Sep 17 00:00:00 2001
+From: James Chapman <[EMAIL PROTECTED]>
+Date: Tue, 10 Jun 2008 12:35:00 -0700
+Subject: [PATCH] l2tp: Fix potential memory corruption in pppol2tp_recvmsg()
+
+This patch fixes a potential memory corruption in
+pppol2tp_recvmsg(). If skb->len is bigger than the caller's buffer
+length, memcpy_toiovec() will go into unintialized data on the kernel
+heap, interpret it as an iovec and start modifying memory.
+
+The fix is to change the memcpy_toiovec() call to
+skb_copy_datagram_iovec() so that paged packets (rare for PPPOL2TP)
+are handled properly. Also check that the caller's buffer is big
+enough for the data and set the MSG_TRUNC flag if it is not so.
+
+Reported-by: Ilja <[EMAIL PROTECTED]>
+Signed-off-by: James Chapman <[EMAIL PROTECTED]>
+Signed-off-by: David S. Miller <[EMAIL PROTECTED]>
+---
+ drivers/net/pppol2tp.c | 20 ++++++++++++--------
+ 1 files changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
+index 70cfdb4..f929882 100644
+--- a/drivers/net/pppol2tp.c
++++ b/drivers/net/pppol2tp.c
+@@ -783,14 +783,18 @@ static int pppol2tp_recvmsg(struct kiocb *iocb, struct
socket *sock,
+ err = 0;
+ skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
+ flags & MSG_DONTWAIT, &err);
+- if (skb) {
+- err = memcpy_toiovec(msg->msg_iov, (unsigned char *) skb->data,
+- skb->len);
+- if (err < 0)
+- goto do_skb_free;
+- err = skb->len;
+- }
+-do_skb_free:
++ if (!skb)
++ goto end;
++
++ if (len > skb->len)
++ len = skb->len;
++ else if (len < skb->len)
++ msg->msg_flags |= MSG_TRUNC;
++
++ err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, len);
++ if (likely(err == 0))
++ err = len;
++
+ kfree_skb(skb);
+ end:
+ return err;
+--
+1.5.5
+
diff --git a/source/base/kernel/FrugalBuild b/source/base/kernel/FrugalBuild
index c0fa674..5b860cf 100644
--- a/source/base/kernel/FrugalBuild
+++ b/source/base/kernel/FrugalBuild
@@ -1,5 +1,5 @@
# Compiling Time: 8.92 SBU
# Maintainer: VMiklos <[EMAIL PROTECTED]>
-_F_kernel_patches=(iTCO_wdt_ICH9DO.patch)
+_F_kernel_patches=(iTCO_wdt_ICH9DO.patch CVE-2008-2750.patch)
Finclude kernel
_______________________________________________
Frugalware-git mailing list
[email protected]
http://frugalware.org/mailman/listinfo/frugalware-git
