Skip to main content

Browse the archive

swh:1:snp:77163734605b0ec556b01d897b7bb4a7e30d46b6
Revision f41d5bb1d9f49b03af7126d07a511facbe283a92 authored by Patrick McHardy on 22 May 2006, 23:55:14 UTC, committed by David S. Miller on 22 May 2006, 23:55:14 UTC 
[NETFILTER]: SNMP NAT: fix memory corruption
 
Fix memory corruption caused by snmp_trap_decode:

- When snmp_trap_decode fails before the id and address are allocated,
  the pointers contain random memory, but are freed by the caller
  (snmp_parse_mangle).

- When snmp_trap_decode fails after allocating just the ID, it tries
  to free both address and ID, but the address pointer still contains
  random memory. The caller frees both ID and random memory again.

- When snmp_trap_decode fails after allocating both, it frees both,
  and the callers frees both again.

The corruption can be triggered remotely when the ip_nat_snmp_basic
module is loaded and traffic on port 161 or 162 is NATed.

Found by multiple testcases of the trap-app and trap-enc groups of the
PROTOS c06-snmpv1 testsuite.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent f5565f4
History
Tip revision: a4412fdd49dc011bcc2c0d81ac4cab7457092650 authored by Steven Rostedt (Google) on 21 November 2022, 15:44:03 UTC
error-injection: Add prompt for function error injection
Tip revision: a4412fd
File Mode Size
Documentation
arch
block
crypto
drivers
fs
include
init
ipc
kernel
lib
mm
net
scripts
security
sound
usr
.gitignore -rw-r--r-- 462 bytes
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 87.4 KB
Kbuild -rw-r--r-- 1.2 KB
MAINTAINERS -rw-r--r-- 68.5 KB
Makefile -rw-r--r-- 43.7 KB
README -rw-r--r-- 16.2 KB
REPORTING-BUGS -rw-r--r-- 3.0 KB

README

back to top