From b2766296767dc2ef705f3ea5e17c9b3f260558ba Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Fri, 13 Sep 2013 07:38:51 -0400 Subject: [PATCH] CVE-2013-4343 net: use-after-free TUNSETIFF (rhbz 1007733 1007741) --- kernel.spec | 9 +++ ...orrectly-handle-error-in-tun_set_iff.patch | 57 +++++++++++++++++++ 2 files changed, 66 insertions(+) create mode 100644 tuntap-correctly-handle-error-in-tun_set_iff.patch diff --git a/kernel.spec b/kernel.spec index 0a1cd7402..5092b0963 100644 --- a/kernel.spec +++ b/kernel.spec @@ -751,6 +751,9 @@ Patch26000: acpi-pcie-hotplug-conflict.patch #rhbz 1002351 Patch25100: crypto-fix-race-in-larval-lookup.patch +#CVE-2013-4343 rhbz 1007733 1007741 +Patch25101: tuntap-correctly-handle-error-in-tun_set_iff.patch + # END OF PATCH DEFINITIONS %endif @@ -1450,6 +1453,9 @@ ApplyPatch acpi-pcie-hotplug-conflict.patch #rhbz1002351 ApplyPatch crypto-fix-race-in-larval-lookup.patch +#CVE-2013-4343 rhbz 1007733 1007741 +ApplyPatch tuntap-correctly-handle-error-in-tun_set_iff.patch + # END OF PATCH APPLICATIONS %endif @@ -2262,6 +2268,9 @@ fi # and build. %changelog +* Fri Sep 13 2013 Josh Boyer +- CVE-2013-4343 net: use-after-free TUNSETIFF (rhbz 1007733 1007741) + * Thu Sep 12 2013 Josh Boyer - Update HID CVE fixes to fix crash from lenovo-tpkbd driver (rhbz 1003998) diff --git a/tuntap-correctly-handle-error-in-tun_set_iff.patch b/tuntap-correctly-handle-error-in-tun_set_iff.patch new file mode 100644 index 000000000..563526765 --- /dev/null +++ b/tuntap-correctly-handle-error-in-tun_set_iff.patch @@ -0,0 +1,57 @@ +From dff4e504b2addc8053fc47712d44a21f733ef51b Mon Sep 17 00:00:00 2001 +From: Jason Wang +Date: Wed, 11 Sep 2013 18:09:48 +0800 +Subject: [PATCH] tuntap: correctly handle error in tun_set_iff() + +Commit c8d68e6be1c3b242f1c598595830890b65cea64a +(tuntap: multiqueue support) only call free_netdev() on error in +tun_set_iff(). This causes several issues: + +- memory of tun security were leaked +- use after free since the flow gc timer was not deleted and the tfile + were not detached + +This patch solves the above issues. + +Reported-by: Wannes Rombouts +Cc: Michael S. Tsirkin +Signed-off-by: Jason Wang +--- + drivers/net/tun.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index 71af122..68b9aa3 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -1691,11 +1691,11 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr) + INIT_LIST_HEAD(&tun->disabled); + err = tun_attach(tun, file); + if (err < 0) +- goto err_free_dev; ++ goto err_free_flow; + + err = register_netdevice(tun->dev); + if (err < 0) +- goto err_free_dev; ++ goto err_detach; + + if (device_create_file(&tun->dev->dev, &dev_attr_tun_flags) || + device_create_file(&tun->dev->dev, &dev_attr_owner) || +@@ -1739,7 +1739,12 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr) + strcpy(ifr->ifr_name, tun->dev->name); + return 0; + +- err_free_dev: ++err_detach: ++ tun_detach_all(dev); ++err_free_flow: ++ tun_flow_uninit(tun); ++ security_tun_dev_free_security(tun->security); ++err_free_dev: + free_netdev(dev); + return err; + } +-- +1.8.3.1 +