Vladis Dronov 44ec968933 nl80211: check for the required netlink attributes presence ...

commit e785fa0a164aa11001cba931367c7f94ffaff888 upstream.

nl80211_set_rekey_data() does not check if the required attributes
NL80211_REKEY_DATA_{REPLAY_CTR,KEK,KCK} are present when processing
NL80211_CMD_SET_REKEY_OFFLOAD request. This request can be issued by
users with CAP_NET_ADMIN privilege and may result in NULL dereference
and a system crash. Add a check for the required attributes presence.
This patch is based on the patch by bo Zhang.

This fixes CVE-2017-12153.

References: https://bugzilla.redhat.com/show_bug.cgi?id=1491046
Fixes: e5497d766a ("cfg80211/nl80211: support GTK rekey offload")
Cc: <stable@vger.kernel.org> # v3.1-rc1
Reported-by: bo Zhang <zhangbo5891001@gmail.com>
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>

2017-11-01 22:12:42 +01:00

..

9p

p9_client_readdir() fix

2017-06-20 14:04:52 +02:00

802

net/802/mrp: fix lockdep splat

2013-05-14 13:02:30 -07:00

8021q

8021q: fix a potential memory leak

2014-07-28 08:00:04 -07:00

appletalk

appletalk: Fix socket referencing in skb

2014-07-28 08:00:05 -07:00

atm

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

ax25

net: add validation for the socket syscall protocol argument

2016-01-22 19:47:55 -08:00

batman-adv

batman-adv: Fix broadcast/ogm queue limit on a removed interface

2016-06-07 10:42:53 +02:00

bluetooth

Bluetooth: cmtp: cmtp_add_connection() should verify that it's dealing with l2cap socket

2017-11-01 22:12:41 +01:00

bridge

Revert "netfilter: ensure number of counters is >0 in do_replace()"

2016-08-21 23:22:32 +02:00

caif

unix/caif: sk_socket can disappear when state is unlocked

2015-06-22 16:55:51 -07:00

can

can: bcm: fix hrtimer/tasklet termination in bcm op removal

2017-06-20 14:03:12 +02:00

ceph

libceph: force GFP_NOIO for socket allocations

2017-06-20 14:04:38 +02:00

core

net: skb_needs_check() accepts CHECKSUM_NONE for tx

2017-11-01 22:12:41 +01:00

dcb

net: Use netlink_ns_capable to verify the permisions of netlink messages

2014-06-26 15:12:37 -04:00

dccp

dccp: fix memory leak during tear-down of unsuccessful connection request

2017-06-20 14:04:31 +02:00

decnet

decnet: Do not build routes to devices without decnet private data.

2016-06-07 10:42:54 +02:00

dns_resolver

dns_resolver: Null-terminate the right string

2014-07-28 08:00:06 -07:00

dsa

dsa: fix freeing of sparse port allocation

2013-03-25 12:23:41 -04:00

ethernet

net: add ETH_P_802_3_MIN

2013-03-28 01:20:42 -04:00

ieee802154

net: 6lowpan: fix lowpan_header_create non-compression memcpy call

2017-06-08 00:47:00 +02:00

ipv4

tcp: fix xmit timer to only be reset if data ACKed/SACKed

2017-11-01 22:12:42 +01:00

ipv6

udp: consistently apply ufo or fragmentation

2017-11-01 22:12:41 +01:00

ipx

ipx: fix locking regression in ipx_sendmsg and ipx_recvmsg

2014-12-06 15:05:47 -08:00

irda

irda: Fix lockdep annotations in hashbin_delete().

2017-06-20 14:04:21 +02:00

iucv

af_iucv: wrong mapping of sent and confirmed skbs

2014-06-30 20:09:40 -07:00

key

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

l2tp

l2tp: avoid use-after-free caused by l2tp_ip_backlog_recv

2017-06-20 14:04:29 +02:00

lapb

…

llc

net: fix infoleak in llc

2016-06-07 10:42:54 +02:00

mac80211

mac80211: flush delayed work when entering suspend

2017-06-20 14:04:26 +02:00

mac802154

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2013-04-30 03:55:20 -04:00

netfilter

ipvs: SNAT packet replies only for NATed connections

2017-11-01 22:12:41 +01:00

netlabel

netlabel: add address family checks to netlbl_{sock,req}_delattr()

2016-08-27 11:40:37 +02:00

netlink

netlink: don't hold mutex in rcu callback when releasing mmapd ring

2015-10-01 12:07:37 +02:00

netrom

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

nfc

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

openvswitch

openvswitch: fix panic with multiple vlan headers

2014-10-15 08:31:57 +02:00

packet

net/packet: fix overflow in check for tp_reserve

2017-06-20 14:04:49 +02:00

phonet

phonet: properly unshare skbs in phonet_rcv()

2016-01-28 21:49:34 -08:00

rds

RDS: Fix the atomicity for congestion map update

2017-06-20 14:04:52 +02:00

rfkill

net: rfkill: Do not ignore errors from regulator_enable()

2016-08-27 11:40:40 +02:00

rose

net: rose: restore old recvmsg behavior

2014-01-15 15:28:49 -08:00

rxrpc

rxrpc: Fix several cases where a padded len isn't checked in ticket decode

2017-11-01 22:12:42 +01:00

sched

net sched actions: decrement module reference count after table flush.

2017-06-08 00:47:04 +02:00

sctp

sctp: listen on the sock only when it's state is listening or closed

2017-06-20 14:04:51 +02:00

sunrpc

svcrpc: fix oops in absence of krb5 module

2017-06-08 00:46:57 +02:00

tipc

net/tipc: initialize security state for new connection socket

2015-10-01 12:07:35 +02:00

unix

af_unix: move unix_mknod() out of bindlock

2017-06-20 14:04:17 +02:00

vmw_vsock

VSOCK: do not disconnect socket when peer has shutdown SEND only

2016-06-07 10:42:54 +02:00

wimax

…

wireless

nl80211: check for the required netlink attributes presence

2017-11-01 22:12:42 +01:00

x25

net: fix a kernel infoleak in x25 module

2016-06-07 10:42:54 +02:00

xfrm

xfrm: policy: check policy direction value

2017-11-01 22:12:42 +01:00

compat.c

net: compat: Update get_compat_msghdr() to match copy_msghdr_from_user() behaviour

2015-03-26 15:00:56 +01:00

Kconfig

netlink: kconfig: move mmap i/o into netlink kconfig

2013-05-01 15:02:42 -04:00

Makefile

…

nonet.c

…

socket.c

net: socket: fix recvmmsg not returning error from sock_error

2017-06-08 00:46:59 +02:00

sysctl_net.c

net: Update the sysctl permissions handler to test effective uid/gid

2013-10-13 16:08:34 -07:00