commit | 74bef1248bcac595d8aec0b58a7ccc0a0fc401a1 | [log] [tgz] |
---|---|---|
author | Andy Whitcroft <[email protected]> | Thu Mar 23 07:45:44 2017 |
committer | ChromeOS Commit Bot <[email protected]> | Sat Apr 01 06:00:45 2017 |
tree | 532f8057054c68c602ff86b563391fffdfc2bd8b | |
parent | 1adea49f8e4c1daad7b021ce902ea711f531a528 [diff] |
UPSTREAM: xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder Kees Cook has pointed out that xfrm_replay_state_esn_len() is subject to wrapping issues. To ensure we are correctly ensuring that the two ESN structures are the same size compare both the overall size as reported by xfrm_replay_state_esn_len() and the internal length are the same. CVE-2017-7184 Signed-off-by: Andy Whitcroft <[email protected]> Acked-by: Steffen Klassert <[email protected]> Signed-off-by: Linus Torvalds <[email protected]> Signed-off-by: Andrey Ulanov <[email protected]> (chery picked from f843ee6dd019bcece3e74e76ad9df0155655d0df) BUG=b:36733546 TEST=kernel compiles Change-Id: Ifc49ff10d8e8ed8337fa61b5a7129db569892e89 Reviewed-on: https://chromium-review.googlesource.com/462459 Commit-Ready: Andrey Ulanov <[email protected]> Tested-by: Andrey Ulanov <[email protected]> Reviewed-by: Guenter Roeck <[email protected]> (cherry picked from commit 7e02bef7e3154372ec74e232d8936ad9864a90a5) Reviewed-on: https://chromium-review.googlesource.com/465593 Commit-Queue: Andrey Ulanov <[email protected]>