oss-sec mailing list archives

CVE request: kernel: dccp: fix oops on Reset after close


From: Eugene Teo <eugene () redhat com>
Date: Tue, 08 Mar 2011 15:50:36 +0800

https://bugzilla.redhat.com/682954
http://git.kernel.org/linus/720dc34bbbe9493c7bd48b2243058b4e447a929d

"This fixes a bug in the order of dccp_rcv_state_process() that still permitted reception even after closing the socket. A Reset after close thus causes a NULL pointer dereference by not preventing operations on an already torn-down socket."

Thanks, Eugene
--
main(i) { putchar(182623909 >> (i-1) * 5&31|!!(i<7)<<6) && main(++i); }


Current thread: