[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <nycvar.YSQ.7.76.2005121738440.1451610@xnncv>
Date: Tue, 12 May 2020 17:46:44 +0530 (IST)
From: P J P <ppandit@...hat.com>
To: oss security list <oss-security@...ts.openwall.com>
cc: Paolo Abeni <pabeni@...hat.com>, matthew.sheets@...ms.com,
Tyler Hicks <code@...icks.com>
Subject: CVE-2020-10711 Kernel: NetLabel: null pointer dereference while
receiving CIPSO packet with null category
Hello,
NULL pointer dereference(s) issue(s) was found in the Linux kernel's SELinux
subsystem. It occurs while importing the Commercial IP Security Option (CIPSO)
protocol's category bitmap into SELinux's extensible bitmap via
'ebitmap_netlbl_import' routine. While parsing the CIPSO restricted bitmap tag
in 'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate
that category bitmap is present, even if it has not been allocated. This leads
to the said NULL pointer dereference issue while importing the same category
bitmap into SELinux. A remote network user could use this flaw to crash the
system kernel resulting in DoS scenario.
This issue was introduced by upstream commit:
-> https://git.kernel.org/linus/4b8feff251da3d7058b5779e21b33a85c686b974
netlabel: fix the horribly broken catmap functions
* This issue was reported by Matthew Sheets (CC'd).
* Please see a proposed fix patch attached herein.
Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
8685 545E B54C 486B C6EB 271E E285 8B5A F050 DE8D
View attachment "linux-netlabel-cope-with-null-catmap.patch" of type "text/plain" (3004 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
