From: Greg KH <gregkh@linux-foundation•org>
To: Mao Wenan <maowenan@huawei•com>
Cc: stable@vger•kernel.org, edumazet@google•com,
netdev@vger•kernel.org, davem@davemloft•net,
eric.dumazet@gmail•com
Subject: Re: [PATCH stable 4.4 v2 00/11] fix FragmentSmack in stable branch (CVE-2018-5391)
Date: Mon, 4 Feb 2019 11:03:26 +0100 [thread overview]
Message-ID: <20190204100326.GA16835@kroah.com> (raw)
In-Reply-To: <1548384524-174152-1-git-send-email-maowenan@huawei.com>
On Fri, Jan 25, 2019 at 10:48:33AM +0800, Mao Wenan wrote:
> There is one CVE: CVE-2018-5391 kernel: IP fragments with random offsets allow a
> remote denial of service (FragmentSmack),
> A fix is a merge commit in the Linux kernel tree:
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c30f1fc041b74ecdb072dd44f858750414b8b19f
>
> consisting of the following commits:
> 7969e5c40dfd04799d4341f1b7cd266b6e47f227 ip: discard IPv4 datagrams with overlapping segments.
> 385114dec8a49b5e5945e77ba7de6356106713f4 net: modify skb_rbtree_purge to return the truesize of all purged skbs.
> fa0f527358bd900ef92f925878ed6bfbd51305cc ip: use rb trees for IP frag queue.
>
> All above patches are with rb tree to fix this CVE, which is very similar the CVE-2018-5390, that I have backport
> to stable 4.4 branch in last year.
>
> In these patchset, I will backport some patches to fix CVE-2018-5391 with rb tree.
>
> v1->v2: in this patch, ipv6: defrag: drop non-last frags smaller than min mtu
> fix the incorrect return value of nf_ct_frag6_gather.
Thanks for fixing that up, I've queued the patches up now, let's see if
they pass the testers :)
greg k-h
prev parent reply other threads:[~2019-02-04 10:03 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-01-25 2:48 [PATCH stable 4.4 v2 00/11] fix FragmentSmack in stable branch (CVE-2018-5391) Mao Wenan
2019-01-25 2:48 ` [PATCH stable 4.4 v2 01/11] net: speed up skb_rbtree_purge() Mao Wenan
2019-01-25 2:48 ` [PATCH stable 4.4 v2 02/11] ip: discard IPv4 datagrams with overlapping segments Mao Wenan
2019-01-25 2:48 ` [PATCH stable 4.4 v2 03/11] net: modify skb_rbtree_purge to return the truesize of all purged skbs Mao Wenan
2019-01-25 2:48 ` [PATCH stable 4.4 v2 04/11] inet: frags: get rif of inet_frag_evicting() Mao Wenan
2019-01-25 2:48 ` [PATCH stable 4.4 v2 05/11] ip: use rb trees for IP frag queue Mao Wenan
2019-01-25 2:48 ` [PATCH stable 4.4 v2 06/11] ipv6: defrag: drop non-last frags smaller than min mtu Mao Wenan
2019-01-25 2:48 ` [PATCH stable 4.4 v2 07/11] ip: add helpers to process in-order fragments faster Mao Wenan
2019-01-25 2:48 ` [PATCH stable 4.4 v2 08/11] ip: process in-order fragments efficiently Mao Wenan
2019-01-25 2:48 ` [PATCH stable 4.4 v2 09/11] net: ipv4: do not handle duplicate fragments as overlapping Mao Wenan
2019-01-25 2:48 ` [PATCH stable 4.4 v2 10/11] ip: frags: fix crash in ip_do_fragment() Mao Wenan
2019-01-25 2:48 ` [PATCH stable 4.4 v2 11/11] ipv4: frags: precedence bug in ip_expire() Mao Wenan
2019-02-04 10:03 ` Greg KH [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190204100326.GA16835@kroah.com \
--to=gregkh@linux-foundation$(echo .)org \
--cc=davem@davemloft$(echo .)net \
--cc=edumazet@google$(echo .)com \
--cc=eric.dumazet@gmail$(echo .)com \
--cc=maowenan@huawei$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=stable@vger$(echo .)kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox