CVE-2011-4112 (C, published 2012-05-17T11:00Z)
Description: value: The net subsystem in the Linux kernel before 3.1 does not properly restrict use of the IFF_TX_SKB_SHARING flag, which allows local users to cause a denial of service (panic) by leveraging the CAP_NET_ADMIN capability to access /proc/net/pktgen/pgctrl, and then using the pktgen package in conjunction with a bridge device for a VLAN interface.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/torvalds/linux
Files changed:
drivers/isdn/i4l/isdn_net.c
drivers/net/bonding/bond_main.c
drivers/net/ifb.c
drivers/net/macvlan.c
drivers/net/tun.c
drivers/net/veth.c
drivers/net/wan/hdlc_fr.c
drivers/net/wireless/airo.c
drivers/net/wireless/hostap/hostap_main.c
drivers/staging/ath6kl/os/linux/ar6000_drv.c
net/8021q/vlan_dev.c
net/bluetooth/bnep/netdev.c
net/l2tp/l2tp_eth.c
net/mac80211/iface.c
Commit message: net: Audit drivers to identify those needing IFF_TX_SKB_SHARING cleared

After the last patch, We are left in a state in which only drivers calling
ether_setup have IFF_TX_SKB_SHARING set (we assume that drivers touching real
hardware call ether_setup for their net_devices and don't hold any state in
their skbs.  There are a handful of drivers that violate this assumption of
course, and need to be fixed up.  This patch identifies those drivers, and marks
them as not being able to support the safe transmission of skbs by clearning the
IFF_TX_SKB_SHARING flag in priv_flags

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
CC: Karsten Keil <isdn@linux-pingi.de>
CC: "David S. Miller" <davem@davemloft.net>
CC: Jay Vosburgh <fubar@us.ibm.com>
CC: Andy Gospodarek <andy@greyhouse.net>
CC: Patrick McHardy <kaber@trash.net>
CC: Krzysztof Halasa <khc@pm.waw.pl>
CC: "John W. Linville" <linville@tuxdriver.com>
CC: Greg Kroah-Hartman <gregkh@suse.de>
CC: Marcel Holtmann <marcel@holtmann.org>
CC: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: David S. Miller <davem@davemloft.net>


Vulnerable code:
			else
	bond_dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
	dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
	dev->priv_flags	       &= ~IFF_XMIT_DST_RELEASE;
	if (type == ARPHRD_ETHER)
	else
	dev->priv_flags		&= ~IFF_XMIT_DST_RELEASE;


Fixed code:

	/* isdn prepends a header in the tx path, can't share skbs */
	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
			else {
				bond_dev->priv_flags &= ~IFF_TX_SKB_SHARING;
			}
	bond_dev->priv_flags &= ~(IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING);
	dev->priv_flags &= ~(IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING);
	dev->priv_flags	       &= ~(IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING);
		dev->priv_flags &= ~IFF_TX_SKB_SHARING;
	dev->priv_flags &= ~IFF_TX_SKB_SHARING;

	if (type == ARPHRD_ETHER) {
		dev->priv_flags &= ~IFF_TX_SKB_SHARING;
	} else
	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
    dev->priv_flags &= ~IFF_TX_SKB_SHARING;
	dev->priv_flags		&= ~(IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING);
	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
	dev->priv_flags &= ~IFF_TX_SKB_SHARING;