Andy Whitcroft 1c887f963c xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder ...

Kees Cook has pointed out that xfrm_replay_state_esn_len() is subject to
wrapping issues.  To ensure we are correctly ensuring that the two ESN
structures are the same size compare both the overall size as reported
by xfrm_replay_state_esn_len() and the internal length are the same.

CVE-2017-7184
Signed-off-by: Andy Whitcroft <apw@canonical.com>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Change-Id: Iaae0cdacc3ad86146dbfe426ffe6fc01e9a8bc10
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>

2019-08-06 12:26:34 +02:00

..

Kconfig

…

Makefile

…

xfrm_algo.c

…

xfrm_hash.c

…

xfrm_hash.h

…

xfrm_input.c

Merge tag 'v3.4.113' into lineage-16.0

2019-08-05 14:20:47 +02:00

xfrm_ipcomp.c

…

xfrm_output.c

Merge tag 'v3.4.113' into lineage-16.0

2019-08-05 14:20:47 +02:00

xfrm_policy.c

Merge tag 'v3.4.113' into lineage-16.0

2019-08-05 14:20:47 +02:00

xfrm_proc.c

…

xfrm_replay.c

Merge tag 'v3.4.113' into lineage-16.0

2019-08-05 14:20:47 +02:00

xfrm_state.c

…

xfrm_sysctl.c

…

xfrm_user.c

xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder

2019-08-06 12:26:34 +02:00