From ee54dc10fd43d6ab8550a32ac54d6d99ebd3e01c Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Tue, 5 May 2015 09:41:50 -0400 Subject: [PATCH] CVE-2015-3636 ping-sockets use-after-free privilege escalation (rhbz 1218074 1218110) --- ...ng-sk_nulls_node_init-in-ping_unhash.patch | 31 +++++++++++++++++++ kernel.spec | 8 +++++ 2 files changed, 39 insertions(+) create mode 100644 ipv4-Missing-sk_nulls_node_init-in-ping_unhash.patch diff --git a/ipv4-Missing-sk_nulls_node_init-in-ping_unhash.patch b/ipv4-Missing-sk_nulls_node_init-in-ping_unhash.patch new file mode 100644 index 000000000..0b839f7b6 --- /dev/null +++ b/ipv4-Missing-sk_nulls_node_init-in-ping_unhash.patch @@ -0,0 +1,31 @@ +From: "David S. Miller" +Date: Fri, 1 May 2015 22:02:47 -0400 +Subject: [PATCH] ipv4: Missing sk_nulls_node_init() in ping_unhash(). + +If we don't do that, then the poison value is left in the ->pprev +backlink. + +This can cause crashes if we do a disconnect, followed by a connect(). + +Tested-by: Linus Torvalds +Reported-by: Wen Xu +Signed-off-by: David S. Miller +--- + net/ipv4/ping.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c +index 208d5439e59b..787b0d699969 100644 +--- a/net/ipv4/ping.c ++++ b/net/ipv4/ping.c +@@ -158,6 +158,7 @@ void ping_unhash(struct sock *sk) + if (sk_hashed(sk)) { + write_lock_bh(&ping_table.lock); + hlist_nulls_del(&sk->sk_nulls_node); ++ sk_nulls_node_init(&sk->sk_nulls_node); + sock_put(sk); + isk->inet_num = 0; + isk->inet_sport = 0; +-- +2.3.6 + diff --git a/kernel.spec b/kernel.spec index e7926a018..98a056860 100644 --- a/kernel.spec +++ b/kernel.spec @@ -652,6 +652,9 @@ Patch26192: blk-loop-avoid-too-many-pending-per-work-IO.patch #rhbz 1206036 1215989 Patch26193: toshiba_acpi-Do-not-register-vendor-backlight-when-a.patch +#CVE-2015-3636 rhbz 1218074 1218110 +Patch26194: ipv4-Missing-sk_nulls_node_init-in-ping_unhash.patch + # END OF PATCH DEFINITIONS %endif @@ -1418,6 +1421,8 @@ ApplyPatch blk-loop-avoid-too-many-pending-per-work-IO.patch #rhbz 1206036 1215989 ApplyPatch toshiba_acpi-Do-not-register-vendor-backlight-when-a.patch +#CVE-2015-3636 rhbz 1218074 1218110 +ApplyPatch ipv4-Missing-sk_nulls_node_init-in-ping_unhash.patch # END OF PATCH APPLICATIONS @@ -2269,6 +2274,9 @@ fi # # %changelog +* Tue May 05 2015 Josh Boyer +- CVE-2015-3636 ping-sockets use-after-free privilege escalation (rhbz 1218074 1218110) + * Thu Apr 30 2015 Josh Boyer - Fix backlight on various Toshiba machines (rhbz 1206036 1215989)