From e9708970a66ba0bb8e1c0bea2e95de041dcedae1 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Sun, 27 Dec 2015 04:22:33 +0000 Subject: [PATCH] pptp: verify sockaddr_len in pptp_bind() and pptp_connect() (CVE-2015-8569) --- debian/changelog | 1 + ...addr_len-in-pptp_bind-and-pptp_conne.patch | 34 +++++++++++++++++++ debian/patches/series | 1 + 3 files changed, 36 insertions(+) create mode 100644 debian/patches/bugfix/all/pptp-verify-sockaddr_len-in-pptp_bind-and-pptp_conne.patch diff --git a/debian/changelog b/debian/changelog index 17bdf0fa3..4de0dc602 100644 --- a/debian/changelog +++ b/debian/changelog @@ -3,6 +3,7 @@ linux (4.3.3-3) UNRELEASED; urgency=medium [ Ben Hutchings ] * [ppc64*] drm: Enable DRM_AST as module (Closes: #808338) * block: ensure to split after potentially bouncing a bio (Closes: #809082) + * pptp: verify sockaddr_len in pptp_bind() and pptp_connect() (CVE-2015-8569) [ Salvatore Bonaccorso ] * ovl: fix permission checking for setattr (CVE-2015-8660) diff --git a/debian/patches/bugfix/all/pptp-verify-sockaddr_len-in-pptp_bind-and-pptp_conne.patch b/debian/patches/bugfix/all/pptp-verify-sockaddr_len-in-pptp_bind-and-pptp_conne.patch new file mode 100644 index 000000000..ad192d1f6 --- /dev/null +++ b/debian/patches/bugfix/all/pptp-verify-sockaddr_len-in-pptp_bind-and-pptp_conne.patch @@ -0,0 +1,34 @@ +From: WANG Cong +Date: Mon, 14 Dec 2015 13:48:36 -0800 +Subject: pptp: verify sockaddr_len in pptp_bind() and pptp_connect() +Origin: https://git.kernel.org/linus/09ccfd238e5a0e670d8178cf50180ea81ae09ae1 + +Reported-by: Dmitry Vyukov +Signed-off-by: Cong Wang +Signed-off-by: David S. Miller +--- + drivers/net/ppp/pptp.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/net/ppp/pptp.c ++++ b/drivers/net/ppp/pptp.c +@@ -418,6 +418,9 @@ static int pptp_bind(struct socket *sock + struct pptp_opt *opt = &po->proto.pptp; + int error = 0; + ++ if (sockaddr_len < sizeof(struct sockaddr_pppox)) ++ return -EINVAL; ++ + lock_sock(sk); + + opt->src_addr = sp->sa_addr.pptp; +@@ -439,6 +442,9 @@ static int pptp_connect(struct socket *s + struct flowi4 fl4; + int error = 0; + ++ if (sockaddr_len < sizeof(struct sockaddr_pppox)) ++ return -EINVAL; ++ + if (sp->sa_protocol != PX_PROTO_PPTP) + return -EINVAL; + diff --git a/debian/patches/series b/debian/patches/series index 6b0ef059b..94480a9ca 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -107,3 +107,4 @@ bugfix/all/tipc-fix-kfree_skb-of-uninitialised-pointer.patch debian/armhf-sparc64-force-zone_dma-to-be-enabled.patch bugfix/all/ovl-fix-permission-checking-for-setattr.patch bugfix/all/block-ensure-to-split-after-potentially-bouncing-a-b.patch +bugfix/all/pptp-verify-sockaddr_len-in-pptp_bind-and-pptp_conne.patch