Skip to content
This repository

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse code

dccp: check ccid before dereferencing

ccid_hc_rx_getsockopt() and ccid_hc_tx_getsockopt() might be called with
a NULL ccid pointer leading to a NULL pointer dereference. This could
lead to a privilege escalation if the attacker is able to map page 0 and
prepare it with a fake ccid_ops pointer.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Cc: stable@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information...
commit 276bdb82dedb290511467a5a4fdbe9f0b52dce6f 1 parent 3592aae
minipli minipli authored davem330 committed

Showing 1 changed file with 2 additions and 2 deletions. Show diff stats Hide diff stats

  1. +2 2 net/dccp/ccid.h
4 net/dccp/ccid.h
@@ -246,7 +246,7 @@ static inline int ccid_hc_rx_getsockopt(struct ccid *ccid, struct sock *sk,
246 246 u32 __user *optval, int __user *optlen)
247 247 {
248 248 int rc = -ENOPROTOOPT;
249   - if (ccid->ccid_ops->ccid_hc_rx_getsockopt != NULL)
  249 + if (ccid != NULL && ccid->ccid_ops->ccid_hc_rx_getsockopt != NULL)
250 250 rc = ccid->ccid_ops->ccid_hc_rx_getsockopt(sk, optname, len,
251 251 optval, optlen);
252 252 return rc;
@@ -257,7 +257,7 @@ static inline int ccid_hc_tx_getsockopt(struct ccid *ccid, struct sock *sk,
257 257 u32 __user *optval, int __user *optlen)
258 258 {
259 259 int rc = -ENOPROTOOPT;
260   - if (ccid->ccid_ops->ccid_hc_tx_getsockopt != NULL)
  260 + if (ccid != NULL && ccid->ccid_ops->ccid_hc_tx_getsockopt != NULL)
261 261 rc = ccid->ccid_ops->ccid_hc_tx_getsockopt(sk, optname, len,
262 262 optval, optlen);
263 263 return rc;

0 comments on commit 276bdb8

Please sign in to comment.
Something went wrong with that request. Please try again.