6209451203
JIRA: https://issues.redhat.com/browse/RHEL-73817 JIRA: https://issues.redhat.com/browse/RHEL-72282 CVE: CVE-2024-56602 commit b4fcd63f6ef79c73cafae8cf4a114def5fc3d80d Author: Ignat Korchagin <ignat@cloudflare.com> Date: Mon Oct 14 16:38:04 2024 +0100 net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() sock_init_data() attaches the allocated sk object to the provided sock object. If ieee802154_create() fails later, the allocated sk object is freed, but the dangling pointer remains in the provided sock object, which may allow use-after-free. Clear the sk pointer in the sock object on error. Signed-off-by: Ignat Korchagin <ignat@cloudflare.com> Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20241014153808.51894-6-ignat@cloudflare.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com> |
||
|---|---|---|
| .. | ||
| 6lowpan | ||
| Kconfig | ||
| Makefile | ||
| core.c | ||
| core.h | ||
| header_ops.c | ||
| ieee802154.h | ||
| netlink.c | ||
| nl-mac.c | ||
| nl-phy.c | ||
| nl802154.c | ||
| nl802154.h | ||
| nl_policy.c | ||
| rdev-ops.h | ||
| socket.c | ||
| sysfs.c | ||
| sysfs.h | ||
| trace.c | ||
| trace.h | ||