diff options
| author | Patrick McHardy <kaber@trash.net> | 2007-07-22 17:31:40 +0200 |
|---|---|---|
| committer | Adrian Bunk <bunk@stusta.de> | 2007-07-22 17:31:40 +0200 |
| commit | de3b9c4f8bb51494e57f8f938d96cdddb0ce76d4 (patch) | |
| tree | 64bb14e9af3cdbc04f7cd6901b7d7c019863561f /net/ipx | |
| parent | 0343e394510ea3859a5ccb030984b4cdc74281cb (diff) | |
[NETFILTER]: {ip,nf}_conntrack_sctp: fix remotely triggerable NULL ptr dereference (CVE-2007-2876)
When creating a new connection by sending an unknown chunk type, we don't
transition to a valid state, causing a NULL pointer dereference in
sctp_packet when accessing sctp_timeouts[SCTP_CONNTRACK_NONE].
Fix by don't creating new conntrack entry if initial state is invalid.
Noticed by Vilmos Nebehaj <vilmos.nebehaj@ramsys.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Diffstat (limited to 'net/ipx')
0 files changed, 0 insertions, 0 deletions