]> www.infradead.org Git - users/jedix/linux-maple.git/commit
ipv6: prevent speculative execution
authorElena Reshetova <elena.reshetova@intel.com>
Thu, 4 Jan 2018 10:07:33 +0000 (02:07 -0800)
committerKirtikar Kashyap <kirtikar.kashyap@oracle.com>
Fri, 12 Jan 2018 18:20:01 +0000 (10:20 -0800)
commitd85f741ca7479577ed8305ff5d2e979fe49ee1d5
treed2bee57261a35598f5e37f4710f493d9e4d1e101
parent341e126e50e4f8fae1116de4355e3460c8344edf
ipv6: prevent speculative execution

Since the offset value in function raw6_getfrag()
seems to be controllable by userspace and later on
conditionally (upon bound check) used in the
following memcpy, insert an observable speculation
barrier before its usage. This should prevent
observable speculation on that branch and avoid
kernel memory leak.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Orabug: 27340445
CVE: CVE-2017-5753

Signed-off-by: Chuck Anderson <chuck.anderson@oracle.com>
Reviewed-by: John Haxby <john.haxby@oracle.com>
Signed-off-by: Kirtikar Kashyap <kirtikar.kashyap@oracle.com>
net/ipv6/raw.c