From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:57619) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XWRyS-00059J-CR for qemu-devel@nongnu.org; Tue, 23 Sep 2014 11:25:59 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XWRyL-0004TQ-9U for qemu-devel@nongnu.org; Tue, 23 Sep 2014 11:25:52 -0400 Received: from e39.co.us.ibm.com ([32.97.110.160]:35382) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XWRyL-0004SL-1I for qemu-devel@nongnu.org; Tue, 23 Sep 2014 11:25:45 -0400 Received: from /spool/local by e39.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 23 Sep 2014 09:25:37 -0600 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable From: Michael Roth In-Reply-To: <20140918063537.GX9321@dhcp-25-225.brq.redhat.com> References: <20140918063537.GX9321@dhcp-25-225.brq.redhat.com> Message-ID: <20140923152523.16792.42459@loki> Date: Tue, 23 Sep 2014 10:25:23 -0500 Subject: Re: [Qemu-devel] [Qemu-stable] [PATCH v2] slirp: udp: fix NULL pointer dereference because of uninitialized socket List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Petr Matousek , qemu-devel@nongnu.org Cc: Jan Kiszka , qemu-stable@nongnu.org, "Michael S. Tsirkin" Quoting Petr Matousek (2014-09-18 01:35:37) > When guest sends udp packet with source port and source addr 0, > uninitialized socket is picked up when looking for matching and already > created udp sockets, and later passed to sosendto() where NULL pointer > dereference is hit during so->slirp->vnetwork_mask.s_addr access. > = > Fix this by checking that the socket is not just a socket stub. > = > This is CVE-2014-3640. > = > Signed-off-by: Petr Matousek > Reported-by: Xavier Mehrenberger > Reported-by: Stephane Duverger Ping. Looking to pull this in for 2.1.2. Release is "asap" > --- > v1 -> v2 > * change the check so that it's consistent with the rest of the code > = > slirp/udp.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > = > diff --git a/slirp/udp.c b/slirp/udp.c > index 8cc6cb6..f77e00f 100644 > --- a/slirp/udp.c > +++ b/slirp/udp.c > @@ -152,7 +152,7 @@ udp_input(register struct mbuf *m, int iphlen) > * Locate pcb for datagram. > */ > so =3D slirp->udp_last_so; > - if (so->so_lport !=3D uh->uh_sport || > + if (so =3D=3D &slirp->udb || so->so_lport !=3D uh->uh_sport || > so->so_laddr.s_addr !=3D ip->ip_src.s_addr) { > struct socket *tmp; > = > -- = > 1.9.3