qiurui/Centos-kernel-stream-10
1
0
Fork 0
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10.git synced 2026-09-09 00:07:04 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge: sctp: validate cached peer INIT chunk in cookie

Browse Source 
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/3227

JIRA: https://issues.redhat.com/browse/RHEL-190192
CVE: CVE-2026-53246

Patch 1 is CVE fix, and patch 2 is a similar fix for cookie.

Signed-off-by: Xin Long <lxin@redhat.com>

Approved-by: Jamie Bainbridge <jbainbri@redhat.com>
Approved-by: Marcelo Ricardo Leitner <mleitner@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
This commit is contained in:
CKI KWF Bot
2026-08-23 18:51:03 +00:00
parent 6e25e46b40 9b1f6894e2
commit 19b3294cb3
2 changed files with 21 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/sctp/bind_addr.c
+10 -1
View File
@@ -275,6 +275,16 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw_addr_list,
param = (struct sctp_paramhdr *)raw_addr_list;
rawaddr = (union sctp_addr_param *)raw_addr_list;
if (addrs_len < sizeof(*param)) {
retval = -EINVAL;
goto out_err;
}
len = ntohs(param->length);
if (addrs_len < len) {
retval = -EINVAL;
goto out_err;
}
af = sctp_get_af_specific(param_type2af(param->type));
if (unlikely(!af) ||
!af->from_addr_param(&addr, rawaddr, htons(port), 0)) {
@@ -291,7 +301,6 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw_addr_list,
goto out_err;
next:
len = ntohs(param->length);
addrs_len -= len;
raw_addr_list += len;
}
net/sctp/sm_make_chunk.c
+11 -1
View File
@@ -1741,8 +1741,9 @@ struct sctp_association *sctp_unpack_cookie(
struct sk_buff *skb = chunk->skb;
struct sctp_cookie *bear_cookie;
__u8 *digest = ep->digest;
struct sctp_chunkhdr *ch;
unsigned int len, chlen;
enum sctp_scope scope;
unsigned int len;
ktime_t kt;
/* Header size is static data prior to the actual cookie, including
@@ -1770,6 +1771,15 @@ struct sctp_association *sctp_unpack_cookie(
cookie = chunk->subh.cookie_hdr;
bear_cookie = &cookie->c;
ch = (struct sctp_chunkhdr *)(bear_cookie + 1);
chlen = ntohs(ch->length);
if (chlen < sizeof(struct sctp_init_chunk))
goto malformed;
if (chlen > len - fixed_size)
goto malformed;
if (bear_cookie->raw_addr_list_len > len - fixed_size - chlen)
goto malformed;
if (!sctp_sk(ep->base.sk)->hmac)
goto no_hmac;