]> git.kernelconcepts.de Git - karo-tx-linux.git/commit
[NETFILTER]: {ip,nf}_conntrack_sctp: fix remotely triggerable NULL ptr dereference...
authorPatrick McHardy <kaber@trash.net>
Sun, 22 Jul 2007 15:31:40 +0000 (17:31 +0200)
committerAdrian Bunk <bunk@stusta.de>
Sun, 22 Jul 2007 15:31:40 +0000 (17:31 +0200)
commitde3b9c4f8bb51494e57f8f938d96cdddb0ce76d4
tree64bb14e9af3cdbc04f7cd6901b7d7c019863561f
parent0343e394510ea3859a5ccb030984b4cdc74281cb
[NETFILTER]: {ip,nf}_conntrack_sctp: fix remotely triggerable NULL ptr dereference (CVE-2007-2876)

When creating a new connection by sending an unknown chunk type, we don't
transition to a valid state, causing a NULL pointer dereference in
sctp_packet when accessing sctp_timeouts[SCTP_CONNTRACK_NONE].

Fix by don't creating new conntrack entry if initial state is invalid.

Noticed by Vilmos Nebehaj <vilmos.nebehaj@ramsys.hu>

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
net/ipv4/netfilter/ip_conntrack_proto_sctp.c
net/netfilter/nf_conntrack_proto_sctp.c