Author: dannf
Date: Wed Dec 20 23:05:34 2006
New Revision: 8032
Added:
dists/sarge-security/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/dvb-core-handle-0-length-ule-sndu.dpatch
Modified:
dists/sarge-security/kernel/source/kernel-source-2.6.8-2.6.8/debian/changelog
dists/sarge-security/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/series/2.6.8-16sarge7
Log:
* dvb-core-handle-0-length-ule-sndu.dpatch
[SECURITY] Avoid sending invalid ULE packets which may not properly
handled by the receiving side triggering a crash. This is a backport
of the patch that went into 2.6.17.y. It would be better to fix the
receiving end, but no patch for the era kernel has been developed yet.
See CVE-2006-4623
Modified:
dists/sarge-security/kernel/source/kernel-source-2.6.8-2.6.8/debian/changelog
==============================================================================
---
dists/sarge-security/kernel/source/kernel-source-2.6.8-2.6.8/debian/changelog
(original)
+++
dists/sarge-security/kernel/source/kernel-source-2.6.8-2.6.8/debian/changelog
Wed Dec 20 23:05:34 2006
@@ -11,8 +11,14 @@
[SECURITY] Correct an error path in dev_queue_xmit() to rebalance
local_bh_enable() calls. Patch from Vasily Averin.
See CVE-2006-6535
+ * dvb-core-handle-0-length-ule-sndu.dpatch
+ [SECURITY] Avoid sending invalid ULE packets which may not properly
+ handled by the receiving side triggering a crash. This is a backport
+ of the patch that went into 2.6.17.y. It would be better to fix the
+ receiving end, but no patch for the era kernel has been developed yet.
+ See CVE-2006-4623
- -- dann frazier <[EMAIL PROTECTED]> Sun, 17 Dec 2006 14:12:33 -0700
+ -- dann frazier <[EMAIL PROTECTED]> Wed, 20 Dec 2006 14:59:57 -0700
kernel-source-2.6.8 (2.6.8-16sarge6) stable-security; urgency=high
Added:
dists/sarge-security/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/dvb-core-handle-0-length-ule-sndu.dpatch
==============================================================================
--- (empty file)
+++
dists/sarge-security/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/dvb-core-handle-0-length-ule-sndu.dpatch
Wed Dec 20 23:05:34 2006
@@ -0,0 +1,35 @@
+From: Ang Way Chuang <[EMAIL PROTECTED]>
+Date: Fri, 1 Sep 2006 06:13:01 +0000 (+0800)
+Subject: dvb-core: Proper handling ULE SNDU length of 0 (CVE-2006-4623)
+X-Git-Url:
http://www.kernel.org/git/?p=linux/kernel/git/stable/linux-2.6.17.y.git;a=commitdiff;h=b7a7e34e7e033822ffef7386b1b884edede7f6c5
+
+dvb-core: Proper handling ULE SNDU length of 0 (CVE-2006-4623)
+
+ULE (Unidirectional Lightweight Encapsulation RFC 4326) decapsulation
+code has a bug that allows an attacker to send a malformed ULE packet
+with SNDU length of 0 and bring down the receiving machine. This patch
+fix the bug and has been tested on version 2.6.17.11. This bug is 100%
+reproducible and the modified source code (GPL) used to produce this bug
+will be posted on http://nrg.cs.usm.my/downloads.htm shortly. The
+kernel will produce a dump during CRC32 checking on faulty ULE packet.
+
+
+Signed-off-by: Ang Way Chuang <[EMAIL PROTECTED]>
+Signed-off-by: Greg Kroah-Hartman <[EMAIL PROTECTED]>
+---
+
+Backported to Debian's 2.6.8 by dann frazier <[EMAIL PROTECTED]>
+
+diff -urN kernel-source-2.6.8.orig/drivers/media/dvb/dvb-core/dvb_net.c
kernel-source-2.6.8/drivers/media/dvb/dvb-core/dvb_net.c
+--- kernel-source-2.6.8.orig/drivers/media/dvb/dvb-core/dvb_net.c
2004-08-13 23:36:31.000000000 -0600
++++ kernel-source-2.6.8/drivers/media/dvb/dvb-core/dvb_net.c 2006-12-20
11:10:32.672819733 -0700
+@@ -330,7 +330,8 @@
+ /* printk(KERN_WARNING "ULE D-Bit: %d, SNDU len
%u.\n",
+ priv->ule_dbit, priv->ule_sndu_len);
*/
+
+- if (priv->ule_sndu_len > 32763) {
++ if (priv->ule_sndu_len > 32763 ||
++ priv->ule_sndu_len < ((priv->ule_dbit) ? 4
: 4 + ETH_ALEN)) {
+ printk(KERN_WARNING "Invalid ULE SNDU
length %u. "
+ "Resyncing.\n",
priv->ule_sndu_len);
+ hexdump(ts, TS_SZ);
Modified:
dists/sarge-security/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/series/2.6.8-16sarge7
==============================================================================
---
dists/sarge-security/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/series/2.6.8-16sarge7
(original)
+++
dists/sarge-security/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/series/2.6.8-16sarge7
Wed Dec 20 23:05:34 2006
@@ -1,3 +1,4 @@
+ mincore-fixes.dpatch
+ mincore_hang.dpatch
+ dev_queue_xmit-error-path.dpatch
++ dvb-core-handle-0-length-ule-sndu.dpatch
_______________________________________________
Kernel-svn-changes mailing list
[email protected]
http://lists.alioth.debian.org/mailman/listinfo/kernel-svn-changes
