]> git.karo-electronics.de Git - karo-tx-linux.git/commit
[PATCH] IPV6: fix lockup via /proc/net/ip6_flowlabel [CVE-2006-5619]
authorJames Morris <jmorris@namei.org>
Mon, 30 Oct 2006 23:11:21 +0000 (15:11 -0800)
committerChris Wright <chrisw@sous-sol.org>
Sat, 4 Nov 2006 01:33:50 +0000 (17:33 -0800)
commitd0239f35c7ae63dbe715b1cc66e4860c2cb33154
treed92ac71942401c84f87383e52518d3cbae379613
parentf3fcd7f6351e8a95e6f1c2b9fda79b6dbecfc6ca
[PATCH] IPV6: fix lockup via /proc/net/ip6_flowlabel [CVE-2006-5619]

There's a bug in the seqfile handling for /proc/net/ip6_flowlabel, where,
after finding a flowlabel, the code will loop forever not finding any
further flowlabels, first traversing the rest of the hash bucket then just
looping.

This patch fixes the problem by breaking after the hash bucket has been
traversed.

Note that this bug can cause lockups and oopses, and is trivially invoked
by an unpriveleged user.

Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
net/ipv6/ip6_flowlabel.c