net: heap overflow in __audit_sockaddr()
authorDan Carpenter <dan.carpenter@oracle.com>
Wed, 2 Oct 2013 21:27:20 +0000 (00:27 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 4 Nov 2013 12:31:00 +0000 (04:31 -0800)
commit2e8d97ab1f1236d08a8576d5c4b25d3180ff01f6
tree33a15e9fb81f001a8e2c9075837dbea6249ceca4
parentb24b4a82fc96f74d848275c8f1b33df66cbef061
net: heap overflow in __audit_sockaddr()

[ Upstream commit 1661bf364ae9c506bc8795fef70d1532931be1e8 ]

We need to cap ->msg_namelen or it leads to a buffer overflow when we
to the memcpy() in __audit_sockaddr().  It requires CAP_AUDIT_CONTROL to
exploit this bug.

The call tree is:
___sys_recvmsg()
  move_addr_to_user()
    audit_sockaddr()
      __audit_sockaddr()

Reported-by: Jüri Aedla <juri.aedla@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/compat.c
net/socket.c