From 341e126e50e4f8fae1116de4355e3460c8344edf Mon Sep 17 00:00:00 2001 From: Elena Reshetova Date: Thu, 4 Jan 2018 02:03:54 -0800 Subject: [PATCH] ipv4: prevent speculative execution Since the offset value in function raw_getfrag() seems to be controllable by userspace and later on conditionally (upon bound check) used in the following memcpy, insert an observable speculation barrier before its usage. This should prevent observable speculation on that branch and avoid kernel memory leak. Signed-off-by: Elena Reshetova Orabug: 27340445 CVE: CVE-2017-5753 Signed-off-by: Chuck Anderson Reviewed-by: John Haxby Signed-off-by: Kirtikar Kashyap --- net/ipv4/raw.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c index 3e24498e8ffc..14dee7ef1fc1 100644 --- a/net/ipv4/raw.c +++ b/net/ipv4/raw.c @@ -466,6 +466,7 @@ static int raw_getfrag(void *from, char *to, int offset, int len, int odd, if (offset < rfv->hlen) { int copy = min(rfv->hlen - offset, len); + osb(); if (skb->ip_summed == CHECKSUM_PARTIAL) memcpy(to, rfv->hdr.c + offset, copy); else -- 2.50.1