Xin Long c665025c19 sctp: add vtag check in sctp_sf_violation ...

[ Upstream commit aa0f697e45 ]

sctp_sf_violation() is called when processing HEARTBEAT_ACK chunk
in cookie_wait state, and some other places are also using it.

The vtag in the chunk's sctphdr should be verified, otherwise, as
later in chunk length check, it may send abort with the existent
asoc's vtag, which can be exploited by one to cook a malicious
chunk to terminate a SCTP asoc.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2023-05-16 12:02:10 +09:00

..

associola.c

sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket

2023-05-16 08:21:01 +09:00

auth.c

sctp: fix sctp_auth_init_hmacs() error path

2023-05-16 09:24:14 +09:00

bind_addr.c

sctp: validate from_addr_param return

2023-05-16 11:52:53 +09:00

chunk.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2016-10-02 22:20:41 -04:00

debug.c

net: sctp: fix array overrun read on sctp_timer_tbl

2017-12-09 22:01:53 +01:00

endpointola.c

sctp: cache netns in sctp_ep_common

2023-05-15 16:08:32 +09:00

input.c

sctp: validate from_addr_param return

2023-05-16 11:52:53 +09:00

inqueue.c

sctp: fix the issue that the cookie-ack with auth can't get processed

2018-05-19 10:26:59 +02:00

ipv6.c

sctp: validate from_addr_param return

2023-05-16 11:52:53 +09:00

Kconfig

sctp: add the sctp_diag.c file

2016-04-15 17:29:36 -04:00

Makefile

sctp: Add GSO support

2016-06-03 19:37:21 -04:00

objcnt.c

sctp: fix checkpatch errors with (foo*)|foo * bar|foo* bar

2013-12-26 13:47:47 -05:00

offload.c

sctp: call gso_reset_checksum when computing checksum in sctp_gso_segment

2023-05-15 11:45:03 +09:00

output.c

sctp: fix the panic caused by route update

2016-10-26 17:32:19 -04:00

outqueue.c

sctp: only update outstanding_bytes for transmitted queue when doing prsctp_prune

2018-02-25 11:05:47 +01:00

primitive.c

sctp: Fix FSF address in file headers

2013-12-06 12:37:56 -05:00

probe.c

net: sctp: Convert log timestamps to be y2038 safe

2016-03-01 17:18:44 -05:00

proc.c

sctp: hold transport before accessing its asoc in sctp_transport_get_next

2023-05-12 17:25:21 +09:00

protocol.c

sctp: validate from_addr_param return

2023-05-16 11:52:53 +09:00

sctp_diag.c

sctp: Avoid out-of-bounds reads from address storage

2017-09-20 08:19:54 +02:00

sm_make_chunk.c

sctp: validate from_addr_param return

2023-05-16 11:52:53 +09:00

sm_sideeffect.c

sctp: change to hold/put transport for proto_unreach_timer

2023-05-16 09:49:00 +09:00

sm_statefuns.c

sctp: add vtag check in sctp_sf_violation

2023-05-16 12:02:10 +09:00

sm_statetable.c

sctp: fix checkpatch errors with indent

2013-12-26 13:47:48 -05:00

socket.c

sctp: delay auto_asconf init until binding the first addr

2023-05-16 11:03:27 +09:00

ssnmap.c

sctp: Fix FSF address in file headers

2013-12-06 12:37:56 -05:00

sysctl.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2016-01-11 23:55:43 -05:00

transport.c

sctp: change to hold/put transport for proto_unreach_timer

2023-05-16 09:49:00 +09:00

tsnmap.c

sctp: Fix FSF address in file headers

2013-12-06 12:37:56 -05:00

ulpevent.c

sctp: remove sctp_chunk_put from fail_mark err path in sctp_ulpevent_make_rcvmsg

2018-05-19 10:26:58 +02:00

ulpqueue.c

sctp: fix missing wake ups in some situations

2017-09-20 08:19:56 +02:00