projects / GitHub / MotorolaMobilityLLC / kernel-slsi.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 0414c78) | patch
netfilter: nf_reject_ipv4: Fix use-after-free in send_reset
authorTejaswi Tanikella <tejaswit@codeaurora.org>
Mon, 23 Oct 2017 06:16:03 +0000 (11:46 +0530)
committerPablo Neira Ayuso <pablo@netfilter.org>
Wed, 1 Nov 2017 11:15:29 +0000 (12:15 +0100)
commit7400bb4b5800831581a82f71700af6a5e815c3c8
treeaabbc224b7f7d620573fd638431a26f0442eac59tree | snapshot (tar.gz zip)
parent0414c78f14861cb704d6e6888efd53dd36e3bddecommit | diff
netfilter: nf_reject_ipv4: Fix use-after-free in send_reset

niph is not updated after pskb_expand_head changes the skb head. It
still points to the freed data, which is then used to update tot_len and
checksum. This could cause use-after-free poison crash.

Update niph, if ip_route_me_harder does not fail.

This only affects the interaction with REJECT targets and br_netfilter.

Signed-off-by: Tejaswi Tanikella <tejaswit@codeaurora.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/ipv4/netfilter/nf_reject_ipv4.c diff | blob | blame | history
Motorola kernel-slsi