]> www.infradead.org Git - users/jedix/linux-maple.git/commit
ipv4: prevent speculative execution
authorElena Reshetova <elena.reshetova@intel.com>
Thu, 4 Jan 2018 10:03:54 +0000 (02:03 -0800)
committerKirtikar Kashyap <kirtikar.kashyap@oracle.com>
Fri, 12 Jan 2018 18:20:01 +0000 (10:20 -0800)
commit341e126e50e4f8fae1116de4355e3460c8344edf
tree6614ea7f298bdbfa56d5ff27a32e5d910a0b4c92
parentb7b26691c72f23cb12e19cf5cc53ba1d1af59388
ipv4: prevent speculative execution

Since the offset value in function raw_getfrag()
seems to be controllable by userspace and later on
conditionally (upon bound check) used in the following
memcpy, insert an observable speculation
barrier before its usage. This should prevent
observable speculation on that branch and avoid
kernel memory leak.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Orabug: 27340445
CVE: CVE-2017-5753

Signed-off-by: Chuck Anderson <chuck.anderson@oracle.com>
Reviewed-by: John Haxby <john.haxby@oracle.com>
Signed-off-by: Kirtikar Kashyap <kirtikar.kashyap@oracle.com>
net/ipv4/raw.c