Re: [Security] inet_diag insufficient validation?

On Fri, 2011-06-03 at 14:55 +0800, Eugene Teo wrote:

Cc'ed acme.

On Wed, Jun 1, 2011 at 11:40 PM, Dan Rosenberg [off-list ref] wrote:

quoted

It seems to me that the auditing performed by inet_diag_bc_audit() is
insufficient to prevent pathological INET_DIAG bytecode from doing bad
things.

Firstly, it's possible to cause an infinite loop in inet_diag_bc_audit()
with a INET_DIAG_BC_JMP opcode with a "yes" value of 0.  The valid_cc()
function, also called from here, seems suspicious as well.

Any chance of getting this fixed?  I have a reproducer available if
necessary.

-Dan