diff options
| author | Eric Andersen | 2004-05-05 07:05:32 +0000 |
|---|---|---|
| committer | Eric Andersen | 2004-05-05 07:05:32 +0000 |
| commit | 6c8161d69fe9fce0f862b678aaa84866aaaeff8f (patch) | |
| tree | 28ca3d47c5325c070ffc3e84b136d8bed02a328f /networking | |
| parent | 5ec58285c3990ebab9900295f1a1d32824338719 (diff) | |
| download | busybox-6c8161d69fe9fce0f862b678aaa84866aaaeff8f.zip busybox-6c8161d69fe9fce0f862b678aaa84866aaaeff8f.tar.gz | |
Steve Grubb writes:
Hello,
Last November a bug was found in iproute. CAN-2003-0856 has more information.
Basically, netlink packets can come from any user. If a program performs action
based on netlink packets, they must be examined to make sure they came from the
place they are expected (the kernel).
Attached is a patch against pre8. Please apply this before releasing 1.00 final.
All users of busy box may be vulnerable to local attacks without it.
Best Regards,
Steve Grubb
Diffstat (limited to 'networking')
| -rw-r--r-- | networking/libiproute/libnetlink.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/networking/libiproute/libnetlink.c b/networking/libiproute/libnetlink.c index 861daef..5545be8 100644 --- a/networking/libiproute/libnetlink.c +++ b/networking/libiproute/libnetlink.c @@ -161,7 +161,8 @@ int rtnl_dump_filter(struct rtnl_handle *rth, while (NLMSG_OK(h, status)) { int err; - if (h->nlmsg_pid != rth->local.nl_pid || + if (nladdr.nl_pid != 0 || + h->nlmsg_pid != rth->local.nl_pid || h->nlmsg_seq != rth->dump) { if (junk) { err = junk(&nladdr, h, arg2); @@ -270,7 +271,8 @@ int rtnl_talk(struct rtnl_handle *rtnl, struct nlmsghdr *n, pid_t peer, bb_error_msg_and_die("!!!malformed message: len=%d", len); } - if (h->nlmsg_pid != rtnl->local.nl_pid || + if (nladdr.nl_pid != peer || + h->nlmsg_pid != rtnl->local.nl_pid || h->nlmsg_seq != seq) { if (junk) { l_err = junk(&nladdr, h, jarg); |