• Lin, Zhenpeng's avatar
    dccp: don't duplicate ccid when cloning dccp sock · d9ea761f
    Lin, Zhenpeng authored
    Commit 2677d206 ("dccp: don't free ccid2_hc_tx_sock ...") fixed
    a UAF but reintroduced CVE-2017-6074.
    
    When the sock is cloned, two dccps_hc_tx_ccid will reference to the
    same ccid. So one can free the ccid object twice from two socks after
    cloning.
    
    This issue was found by "Hadar Manor" as well and assigned with
    CVE-2020-16119, which was fixed in Ubuntu's kernel. So here I port
    the patch from Ubuntu to fix it.
    
    The patch prevents cloned socks from referencing the same ccid.
    
    Fixes: 2677d206 ("dccp: don't free ccid2_hc_tx_sock ...")
    Signed-off-by: default avatarZhenpeng Lin <zplin@psu.edu>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    d9ea761f
minisocks.c 7.34 KB