From: Jesse Gross <je...@nicira.com>
Date: Sat, 7 Sep 2013 22:35:33 -0700
> On Sat, Sep 7, 2013 at 12:41 AM, Daniel Borkmann <dbork...@redhat.com> wrote:
>> In function __parse_flow_nlattrs(), we check for condition
>> (type > OVS_KEY_ATTR_MAX) and if true, print an error, but we do
>> not return from this function as in other checks. It seems this
>> has been forgotten, as otherwise, we could access beyond the
>> memory of ovs_key_lens, which is of ovs_key_lens[OVS_KEY_ATTR_MAX + 1].
>> Hence, a maliciously prepared nla_type from user space could access
>> beyond this upper limit.
>>
>> Introduced by 03f0d916a ("openvswitch: Mega flow implementation").
>>
>> Signed-off-by: Daniel Borkmann <dbork...@redhat.com>
>> Cc: Andy Zhou <az...@nicira.com>
>
> Yeah, looks like a mistake to me.
>
> Acked-by: Jesse Gross <je...@nicira.com>
Applied, thanks.
_______________________________________________
dev mailing list
dev@openvswitch.org
http://openvswitch.org/mailman/listinfo/dev
