linux/net/bridge
Kirill Korotaev ee4bb818ae [NETFILTER]: Fix possible overflow in netfilters do_replace()
netfilter's do_replace() can overflow on addition within SMP_ALIGN()
and/or on multiplication by NR_CPUS, resulting in a buffer overflow on
the copy_from_user().  In practice, the overflow on addition is
triggerable on all systems, whereas the multiplication one might require
much physical memory to be present due to the check above.  Either is
sufficient to overwrite arbitrary amounts of kernel memory.

I really hate adding the same check to all 4 versions of do_replace(),
but the code is duplicate...

Found by Solar Designer during security audit of OpenVZ.org

Signed-Off-By: Kirill Korotaev <dev@openvz.org>
Signed-Off-By: Solar Designer <solar@openwall.com>
Signed-off-by: Patrck McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-02-04 23:51:25 -08:00
..
netfilter [NETFILTER]: Fix possible overflow in netfilters do_replace() 2006-02-04 23:51:25 -08:00
Kconfig [NET]: move config options out to individual protocols 2005-07-11 21:13:56 -07:00
Makefile Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
br.c [BRIDGE]: add version number 2006-01-03 13:11:04 -08:00
br_device.c [BRIDGE]: limited ethtool support 2006-01-03 13:11:03 -08:00
br_fdb.c [BRIDGE]: Use ether_compare 2005-10-31 16:34:10 -02:00
br_forward.c [BRIDGE]: TSO fix in br_dev_queue_push_xmit 2005-09-22 23:35:34 -07:00
br_if.c [BRIDGE]: Fix device delete race. 2006-01-31 17:44:07 -08:00
br_input.c [NET]: Use newer is_multicast_ether_addr() in some files 2006-01-06 13:05:58 -08:00
br_ioctl.c [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
br_netfilter.c [BRIDGE] netfilter: vlan + hw checksum = bug? 2006-01-06 13:13:29 -08:00
br_notify.c [BRIDGE]: handle speed detection after carrier changes 2006-01-03 13:11:01 -08:00
br_private.h [BRIDGE]: Fix device delete race. 2006-01-31 17:44:07 -08:00
br_private_stp.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
br_stp.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
br_stp_bpdu.c [BRIDGE]: prevent bad forwarding table updates 2005-05-29 14:15:55 -07:00
br_stp_if.c [BRIDGE]: Fix faulty check in br_stp_recalculate_bridge_id() 2006-01-03 14:35:54 -08:00
br_stp_timer.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
br_sysfs_br.c [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
br_sysfs_if.c [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00