projects / GitHub / moto-9609 / android_kernel_motorola_exynos9610.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 196896d) | patch
net: heap overflow in __audit_sockaddr()
authorDan Carpenter <dan.carpenter@oracle.com>
Wed, 2 Oct 2013 21:27:20 +0000 (00:27 +0300)
committerDavid S. Miller <davem@davemloft.net>
Thu, 3 Oct 2013 20:05:14 +0000 (16:05 -0400)
commit1661bf364ae9c506bc8795fef70d1532931be1e8
tree2ce62724a9931016cbbdb1bb94bc140012524c71tree | snapshot (tar.gz zip)
parent196896d4bb297e3ff24e62b2bfc22bbed7a28431commit | diff
net: heap overflow in __audit_sockaddr()

We need to cap ->msg_namelen or it leads to a buffer overflow when we
to the memcpy() in __audit_sockaddr().  It requires CAP_AUDIT_CONTROL to
exploit this bug.

The call tree is:
___sys_recvmsg()
  move_addr_to_user()
    audit_sockaddr()
      __audit_sockaddr()

Reported-by: Jüri Aedla <juri.aedla@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/compat.c diff | blob | blame | history
net/socket.c diff | blob | blame | history