A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 08:07:32 -04:00
Code Issues Projects Releases Packages Wiki Activity

MobileAP: CVE-2022-2663 fix revert kernel change

Browse source 
Added CVE-2022-2663 fix revert kernel change

Change-Id: I0230a6bc4fd3903c918bce86a5e5728c044b3e3b
Signed-off-by: Dheeraj Kumar <quic_dhekum@quicinc.com>
This commit is contained in:
Dheeraj Kumar 2023-11-10 07:27:40 +00:00
commit 253ff03050
1 changed files with 32 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

40
net/netfilter/nf_conntrack_irc.c
View file

@ -435,15 +435,38 @@ static int help(struct sk_buff *skb, unsigned int protoff,
* 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14
*/
data = ib_ptr;
while (data < data_limit - (19 + MINMATCHLEN)) {
if (memcmp(data, "\1DCC ", 5)) {
/* Skip any whitespace */
while (data < data_limit - 10) {
if (*data == ' ' || *data == '\r' || *data == '\n')
data++;
else
break;
}
/* strlen("PRIVMSG x ")=10 */
if (data < data_limit - 10) {
if (strncasecmp("PRIVMSG ", data, 8))
goto out;
data += 8;
}
/* strlen(" :\1DCC SENT t AAAAAAAA P\1\n")=26
* 7+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=26
*/
while (data < data_limit - (21 + MINMATCHLEN)) {
/* Find first " :", the start of message */
if (memcmp(data, " :", 2)) {
data++;
continue;
}
data += 2;
/* then check that place only for the DCC command */
if (memcmp(data, "\1DCC ", 5))
goto out;
data += 5;
/* we have at least (19+MINMATCHLEN)-5
*bytes valid data left
*/
/* we have at least (21+MINMATCHLEN)-(2+5) bytes valid data left */
iph = ip_hdr(skb);
pr_debug("DCC found in master %pI4:%u %pI4:%u\n",
&iph->saddr, ntohs(th->source),
@ -459,7 +482,7 @@ static int help(struct sk_buff *skb, unsigned int protoff,
pr_debug("DCC %s detected\n", dccprotos[i]);
/* we have at least
* (19+MINMATCHLEN)-5-dccprotos[i].matchlen
* (21+MINMATCHLEN)-7-dccprotos[i].matchlen
*bytes valid data left (== 14/13 bytes)
*/
if (parse_dcc(data, data_limit, &dcc_ip,
@ -476,8 +499,9 @@ static int help(struct sk_buff *skb, unsigned int protoff,
*external (NAT'ed) IP
*/
tuple = &ct->tuplehash[dir].tuple;
if (tuple->src.u3.ip != dcc_ip &&
tuple->dst.u3.ip != dcc_ip) {
if ((tuple->src.u3.ip != dcc_ip &&
ct->tuplehash[!dir].tuple.dst.u3.ip != dcc_ip) ||
dcc_port == 0) {
net_warn_ratelimited("Forged DCC command from %pI4: %pI4:%u\n",
&tuple->src.u3.ip,
&dcc_ip, dcc_port);