[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 3a69555f909b4124bae270c16b397e7873c2db7d

[Arne Fitzenreiter <git@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 3951 bytes --]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  3a69555f909b4124bae270c16b397e7873c2db7d (commit)
      from  9dafa28a1c2df8335de30db300e2ca4093e57ccd (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 3a69555f909b4124bae270c16b397e7873c2db7d
Author: Arne Fitzenreiter <arne_f(a)ipfire.org>
Date:   Sat Sep 12 09:38:10 2020 +0200

    kernel: add patch agains CVE-2020-14386
    
    fixes #12483
    
    Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 lfs/linux                                          |  3 ++
 ...86_net_packet_fix_overflow_in_tpacket_rcv.patch | 44 ++++++++++++++++++++++
 2 files changed, 47 insertions(+)
 create mode 100644 src/patches/linux/linux-4.14_cve-2020-14386_net_packet_fix_overflow_in_tpacket_rcv.patch

Difference in files:
diff --git a/lfs/linux b/lfs/linux
index 8bec96150..cb9942938 100644
--- a/lfs/linux
+++ b/lfs/linux
@@ -144,6 +144,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-random_try_to_actively_add_entropy.patch
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-4.14.x-add_timer_setup_on_stack.patch
 
+	# Patch CVE-2020-14386
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-4.14_cve-2020-14386_net_packet_fix_overflow_in_tpacket_rcv.patch
+
 ifeq "$(KCFG)" "-multi"
 	# Apply Arm-multiarch kernel patches.
 	cd $(DIR_APP) && xzcat $(DIR_DL)/arm-multi-patches-$(ARM_PATCHES).patch.xz | patch -Np1
diff --git a/src/patches/linux/linux-4.14_cve-2020-14386_net_packet_fix_overflow_in_tpacket_rcv.patch b/src/patches/linux/linux-4.14_cve-2020-14386_net_packet_fix_overflow_in_tpacket_rcv.patch
new file mode 100644
index 000000000..a3eb3231f
--- /dev/null
+++ b/src/patches/linux/linux-4.14_cve-2020-14386_net_packet_fix_overflow_in_tpacket_rcv.patch
@@ -0,0 +1,44 @@
+From: Arne Fitzenreiter <arne.fitzenreiter(a)ipfire.org>
+
+patch based on acf69c946233259ab4d64f8869d4037a198c7f06
+From: Or Cohen <orcohen(a)paloaltonetworks.com>
+Subject: net/packet: fix overflow in tpacket_rcv
+
+Using tp_reserve to calculate netoff can overflow as
+tp_reserve is unsigned int and netoff is unsigned short.
+
+This may lead to macoff receving a smaller value then
+sizeof(struct virtio_net_hdr), and if po->has_vnet_hdr
+is set, an out-of-bounds write will occur when
+calling virtio_net_hdr_from_skb.
+
+The bug is fixed by converting netoff to unsigned int
+and checking if it exceeds USHRT_MAX.
+
+This addresses CVE-2020-14386
+
+
+diff -Naur linux-4.14.197.org/net/packet/af_packet.c linux-4.14.197/net/packet/af_packet.c
+--- linux-4.14.197.org/net/packet/af_packet.c	2020-09-11 22:27:31.003458577 +0200
++++ linux-4.14.197/net/packet/af_packet.c	2020-09-11 22:38:53.104021712 +0200
+@@ -2201,7 +2201,8 @@
+ 	int skb_len = skb->len;
+ 	unsigned int snaplen, res;
+ 	unsigned long status = TP_STATUS_USER;
+-	unsigned short macoff, netoff, hdrlen;
++	unsigned short macoff, hdrlen;
++	unsigned int netoff;
+ 	struct sk_buff *copy_skb = NULL;
+ 	struct timespec ts;
+ 	__u32 ts_status;
+@@ -2264,6 +2265,10 @@
+ 		}
+ 		macoff = netoff - maclen;
+ 	}
++	if (netoff > USHRT_MAX) {
++		po->stats.stats1.tp_drops++;
++		goto drop_n_restore;
++	}
+ 	if (po->tp_version <= TPACKET_V2) {
+ 		if (macoff + snaplen > po->rx_ring.frame_size) {
+ 			if (po->copy_thresh &&


hooks/post-receive
--
IPFire 2.x development tree