linux/net/bridge/netfilter
Kirill Korotaev ee4bb818ae [NETFILTER]: Fix possible overflow in netfilters do_replace()
netfilter's do_replace() can overflow on addition within SMP_ALIGN()
and/or on multiplication by NR_CPUS, resulting in a buffer overflow on
the copy_from_user().  In practice, the overflow on addition is
triggerable on all systems, whereas the multiplication one might require
much physical memory to be present due to the check above.  Either is
sufficient to overwrite arbitrary amounts of kernel memory.

I really hate adding the same check to all 4 versions of do_replace(),
but the code is duplicate...

Found by Solar Designer during security audit of OpenVZ.org

Signed-Off-By: Kirill Korotaev <dev@openvz.org>
Signed-Off-By: Solar Designer <solar@openwall.com>
Signed-off-by: Patrck McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-02-04 23:51:25 -08:00
..
Kconfig [NETFILTER] ebtables: Support nf_log API from ebt_log and ebt_ulog 2006-01-03 13:10:30 -08:00
Makefile Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
ebt_802_3.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
ebt_among.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
ebt_arp.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
ebt_arpreply.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
ebt_dnat.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
ebt_ip.c [EBTABLES]: Handle SCTP/DCCP in ebt_{ip,log} 2006-01-17 13:01:31 -08:00
ebt_limit.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
ebt_log.c [EBTABLES]: Handle SCTP/DCCP in ebt_{ip,log} 2006-01-17 13:01:31 -08:00
ebt_mark.c [NETFILTER]: reduce netfilter sk_buff enlargement 2005-08-29 15:31:04 -07:00
ebt_mark_m.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
ebt_pkttype.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
ebt_redirect.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
ebt_snat.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
ebt_stp.c [NET]: Some more missing include/etherdevice.h includes 2006-01-11 16:32:11 -08:00
ebt_ulog.c [NETFILTER]: Fix undersized skb allocation in ipt_ULOG/ebt_ulog/nfnetlink_log 2006-02-04 23:51:19 -08:00
ebt_vlan.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
ebtable_broute.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
ebtable_filter.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
ebtable_nat.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
ebtables.c [NETFILTER]: Fix possible overflow in netfilters do_replace() 2006-02-04 23:51:25 -08:00