Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Leap:42.3
xen
CVE-2014-3640-qemut-slirp-NULL-pointer-deref-in...
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File CVE-2014-3640-qemut-slirp-NULL-pointer-deref-in-sosendto.patch of Package xen
Subject: slirp: udp: fix NULL pointer dereference because of uninitialized socket From: Petr Matousek pmatouse@redhat.com Thu Sep 18 08:35:37 2014 +0200 Date: Tue Sep 23 19:15:05 2014 +0100: Git: 01f7cecf0037997cb0e58ec0d56bf9b5a6f7cb2a When guest sends udp packet with source port and source addr 0, uninitialized socket is picked up when looking for matching and already created udp sockets, and later passed to sosendto() where NULL pointer dereference is hit during so->slirp->vnetwork_mask.s_addr access. Fix this by checking that the socket is not just a socket stub. This is CVE-2014-3640. Signed-off-by: Petr Matousek <pmatouse@redhat.com> Reported-by: Xavier Mehrenberger <xavier.mehrenberger@airbus.com> Reported-by: Stephane Duverger <stephane.duverger@eads.net> Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Message-id: 20140918063537.GX9321@dhcp-25-225.brq.redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Index: xen-4.6.1-testing/tools/qemu-xen-traditional-dir-remote/slirp/udp.c =================================================================== --- xen-4.6.1-testing.orig/tools/qemu-xen-traditional-dir-remote/slirp/udp.c +++ xen-4.6.1-testing/tools/qemu-xen-traditional-dir-remote/slirp/udp.c @@ -168,7 +168,7 @@ udp_input(m, iphlen) * Locate pcb for datagram. */ so = udp_last_so; - if (so->so_lport != uh->uh_sport || + if (so == &slirp->udb || so->so_lport != uh->uh_sport || so->so_laddr.s_addr != ip->ip_src.s_addr) { struct socket *tmp;
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor