Marcelo Ricardo Leitner 8da6a014f4 sctp: validate chunk size in __rcv_asconf_lookup ...

mainline inclusion
from mainline-v5.14-rc1
commit b6ffe7671b24689c09faa5675dd58f93758a97ae
category: bugfix
issue: #I4589I
CVE: CVE-2021-3655

---------------------------

In one of the fallbacks that SCTP has for identifying an association for an
incoming packet, it looks for AddIp chunk (from ASCONF) and take a peek.
Thing is, at this stage nothing was validating that the chunk actually had
enough content for that, allowing the peek to happen over uninitialized
memory.

Similar check already exists in actual asconf handling in
sctp_verify_asconf().

Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Reviewed-by: Xiu Jianfeng <xiujianfeng@huawei.com>
Reviewed-by: Yue Haibing <yuehaibing@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Yu Changchun <yuchangchun1@huawei.com>

2021-08-16 11:31:51 +08:00

..

associola.c

sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket

2020-06-30 23:17:05 -04:00

auth.c

sctp: fix sctp_auth_init_hmacs() error path

2020-10-14 10:31:23 +02:00

bind_addr.c

sctp: validate from_addr_param return

2021-08-16 11:31:51 +08:00

chunk.c

sctp: frag_point sanity check

2019-12-13 08:52:29 +01:00

debug.c

sctp: add SCTP_CID_I_DATA and SCTP_CID_I_FWD_TSN conversion in sctp_cname

2018-02-12 11:40:01 -05:00

diag.c

inet_diag: return classid for all socket types

2020-03-18 07:14:11 +01:00

endpointola.c

sctp: cache netns in sctp_ep_common

2019-12-05 09:21:32 +01:00

input.c

sctp: validate chunk size in __rcv_asconf_lookup

2021-08-16 11:31:51 +08:00

inqueue.c

sctp: fix the issue that the cookie-ack with auth can't get processed

2018-05-02 11:15:33 -04:00

ipv6.c

sctp: validate from_addr_param return

2021-08-16 11:31:51 +08:00

Kconfig

sctp: whitespace fixes

2018-07-24 14:10:42 -07:00

Makefile

sctp: rename sctp_diag.c as diag.c

2018-02-13 13:56:31 -05:00

objcnt.c

proc: introduce proc_create_seq{,_data}

2018-05-16 07:23:35 +02:00

offload.c

sctp: call gso_reset_checksum when computing checksum in sctp_gso_segment

2019-02-27 10:08:58 +01:00

output.c

sctp: increase sk_wmem_alloc when head->truesize is increased

2019-12-13 08:52:00 +01:00

outqueue.c

sctp: move trace_sctp_probe_path into sctp_outq_sack

2020-10-01 13:14:30 +02:00

primitive.c

sctp: remove the typedef sctp_subtype_t

2017-08-06 21:33:42 -07:00

proc.c

sctp: remove useless start_fail from sctp_ht_iter in proc

2018-08-27 15:13:17 -07:00

protocol.c

sctp: validate from_addr_param return

2021-08-16 11:31:51 +08:00

sm_make_chunk.c

sctp: add param size validation for SCTP_PARAM_SET_PRIMARY

2021-08-16 11:31:51 +08:00

sm_sideeffect.c

sctp: Don't add the shutdown timer if its already been added

2020-06-03 08:19:21 +02:00

sm_statefuns.c

sctp: implement memory accounting on rx path

2020-11-14 16:00:51 +08:00

sm_statetable.c

sctp: implement validate_ftsn for sctp_stream_interleave

2017-12-15 13:52:22 -05:00

socket.c

net/sctp: fix race condition in sctp_destroy_sock

2021-05-31 17:14:52 +08:00

stream_interleave.c

net/sctp: Make wrappers for accessing in/out streams

2018-08-11 12:25:15 -07:00

stream_sched_prio.c

net/sctp: Make wrappers for accessing in/out streams

2018-08-11 12:25:15 -07:00

stream_sched_rr.c

net/sctp: Make wrappers for accessing in/out streams

2018-08-11 12:25:15 -07:00

stream_sched.c

net/sctp: Make wrappers for accessing in/out streams

2018-08-11 12:25:15 -07:00

stream.c

sctp: shrink stream outq when fails to do addstream reconf

2020-07-31 18:37:48 +02:00

sysctl.c

sctp: support sysctl to allow users to use stream interleave

2017-12-15 13:52:22 -05:00

transport.c

net: add bool confirm_neigh parameter for dst_ops.update_pmtu

2020-01-04 19:13:37 +01:00

tsnmap.c

…

ulpevent.c

sctp: implement memory accounting on rx path

2020-11-14 16:00:51 +08:00

ulpqueue.c

sctp: implement memory accounting on rx path

2020-11-14 16:00:51 +08:00