rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Jitsi 2.5.5061 - 2.9.5544.
Vulnerability ID: CVE-2017-5603
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/jitsi/jitsi
Published: 2017-02-09
File: src/net/java/sip/communicator/impl/protocol/jabber/OperationSetBasicInstantMessagingJabberImpl.java
Commit message: Checks from for received carbon messages, should be bare jid.
Commit author: damencho

Vulnerable version (before fix):
 public void processPacket(Packet packet)                         ForwardedPacketExtension.class);                 if(extensions.isEmpty())                     return;                 ForwardedPacketExtension forwardedExt = extensions.get(0);                 msg = forwardedExt.getMessage();                 if(msg == null || msg.getBody() == null)

Fixed version (after fix):
 public void processPacket(Packet packet)                         ForwardedPacketExtension.class);                 if(extensions.isEmpty())                     return;                  // according to xep-0280 all carbons should come from                 // our bare jid                 if (!msg.getFrom().equals(                         StringUtils.parseBareAddress(                             jabberProvider.getOurJID())))                 {                     logger.info("Received a carbon copy with wrong from!");                     return;                 }                  ForwardedPacketExtension forwardedExt = extensions.get(0);                 msg = forwardedExt.getMessage();                 if(msg == null || msg.getBody() == null)

Patch:
patch: @@ -815,6 +815,17 @@ public void processPacket(Packet packet)
                         ForwardedPacketExtension.class);
                 if(extensions.isEmpty())
                     return;
+
+                // according to xep-0280 all carbons should come from
+                // our bare jid
+                if (!msg.getFrom().equals(
+                        StringUtils.parseBareAddress(
+                            jabberProvider.getOurJID())))
+                {
+                    logger.info("Received a carbon copy with wrong from!");
+                    return;
+                }
+
                 ForwardedPacketExtension forwardedExt = extensions.get(0);
                 msg = forwardedExt.getMessage();
                 if(msg == null || msg.getBody() == null)
path: src/net/java/sip/communicator/impl/protocol/jabber/OperationSetBasicInstantMessagingJabberImpl.java
Vulnerability: bitlbee-libpurple before 3.5.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a file transfer request for a contact that is not in the contact list.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-10189.
Vulnerability ID: CVE-2017-5668
CWE: CWE-476
Severity score: 6.4
Project: https://github.com/bitlbee/bitlbee
Published: 2017-03-14
File: protocols/purple/ft.c
Commit message: purple: Fix crash on ft requests from unknown contacts

Followup to 701ab81 (included in 3.5) which was a partial fix which only
improved things for non-libpurple file transfers (that is, just jabber)
Commit author: dequis

Vulnerable version (before fix):
 static gboolean prplcb_xfer_new_send_cb(gpointer data, gint fd, b_input_conditio 	/* TODO(wilmer): After spreading some more const goodness in BitlBee, 	   remove the evil cast below. */ 	px->ft = imcb_file_send_start(ic, (char *) who, xfer->filename, xfer->size); 	px->ft->data = px;  	px->ft->accept = prpl_xfer_accept;

Fixed version (after fix):
 static gboolean prplcb_xfer_new_send_cb(gpointer data, gint fd, b_input_conditio 	/* TODO(wilmer): After spreading some more const goodness in BitlBee, 	   remove the evil cast below. */ 	px->ft = imcb_file_send_start(ic, (char *) who, xfer->filename, xfer->size);  	if (!px->ft) { 		return FALSE; 	} 	px->ft->data = px;  	px->ft->accept = prpl_xfer_accept;

Patch:
patch: @@ -145,6 +145,10 @@ static gboolean prplcb_xfer_new_send_cb(gpointer data, gint fd, b_input_conditio
 	/* TODO(wilmer): After spreading some more const goodness in BitlBee,
 	   remove the evil cast below. */
 	px->ft = imcb_file_send_start(ic, (char *) who, xfer->filename, xfer->size);
+
+	if (!px->ft) {
+		return FALSE;
+	}
 	px->ft->data = px;
 
 	px->ft->accept = prpl_xfer_accept;
path: protocols/purple/ft.c
Vulnerability: The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving extended content descriptors.
Vulnerability ID: CVE-2017-5847
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/GStreamer/gst-plugins-ugly
Published: 2017-02-09
File: gst/asfdemux/gstasfdemux.c
Commit message: asfdemux: Check that we have enough data available before parsing bool/uint extended content descriptors

https://bugzilla.gnome.org/show_bug.cgi?id=777955
Commit author: Sebastian Dröge

Vulnerable version (before fix):
 gst_asf_demux_process_ext_content_desc (GstASFDemux * demux, guint8 * data,           break;         }         case ASF_DEMUX_DATA_TYPE_DWORD:{           guint uint_val = GST_READ_UINT32_LE (value);            /* this is the track number */           g_value_init (&tag_value, G_TYPE_UINT); gst_asf_demux_process_ext_content_desc (GstASFDemux * demux, guint8 * data,         }           /* Detect 3D */         case ASF_DEMUX_DATA_TYPE_BOOL:{           gboolean bool_val = GST_READ_UINT32_LE (value);            if (strncmp ("Stereoscopic", name_utf8, strlen (name_utf8)) == 0) {             if (bool_val) {

Fixed version (after fix):
 gst_asf_demux_process_ext_content_desc (GstASFDemux * demux, guint8 * data,           break;         }         case ASF_DEMUX_DATA_TYPE_DWORD:{           guint uint_val;            if (value_len < 4)             break;            uint_val = GST_READ_UINT32_LE (value);            /* this is the track number */           g_value_init (&tag_value, G_TYPE_UINT); gst_asf_demux_process_ext_content_desc (GstASFDemux * demux, guint8 * data,         }           /* Detect 3D */         case ASF_DEMUX_DATA_TYPE_BOOL:{           gboolean bool_val;            if (value_len < 4)             break;            bool_val = GST_READ_UINT32_LE (value);            if (strncmp ("Stereoscopic", name_utf8, strlen (name_utf8)) == 0) {             if (bool_val) {

Patch:
patch: @@ -3439,7 +3439,12 @@ gst_asf_demux_process_ext_content_desc (GstASFDemux * demux, guint8 * data,
           break;
         }
         case ASF_DEMUX_DATA_TYPE_DWORD:{
-          guint uint_val = GST_READ_UINT32_LE (value);
+          guint uint_val;
+
+          if (value_len < 4)
+            break;
+
+          uint_val = GST_READ_UINT32_LE (value);
 
           /* this is the track number */
           g_value_init (&tag_value, G_TYPE_UINT);
@@ -3453,7 +3458,12 @@ gst_asf_demux_process_ext_content_desc (GstASFDemux * demux, guint8 * data,
         }
           /* Detect 3D */
         case ASF_DEMUX_DATA_TYPE_BOOL:{
-          gboolean bool_val = GST_READ_UINT32_LE (value);
+          gboolean bool_val;
+
+          if (value_len < 4)
+            break;
+
+          bool_val = GST_READ_UINT32_LE (value);
 
           if (strncmp ("Stereoscopic", name_utf8, strlen (name_utf8)) == 0) {
             if (bool_val) {
path: gst/asfdemux/gstasfdemux.c
Vulnerability: Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows remote attackers to inject arbitrary web script or HTML via the nav_data name.
Vulnerability ID: CVE-2017-5938
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/viewvc/viewvc
Published: 2017-03-15
File: lib/viewvc.py
Commit message: Escape some raw path data before handing off to templates

* lib/viewvc.py
  (nav_path): Escape the 'name' property of navigation path components
    the same way we escape that of the 'root' path component.

Reported by: Thomas Gerbet <thomas.gerbet@enalean.com>
Commit author: C. Michael Pilato

Vulnerable version (before fix):
 def nav_path(request):     path_parts.append(part)     is_last = len(path_parts) == len(request.path_parts)      item = _item(name=part, href=None)      if not is_last or (is_dir and request.view_func is not view_directory):       item.href = request.get_url(view_func=view_directory,

Fixed version (after fix):
 def nav_path(request):     path_parts.append(part)     is_last = len(path_parts) == len(request.path_parts)      item = _item(name=request.server.escape(part), href=None)      if not is_last or (is_dir and request.view_func is not view_directory):       item.href = request.get_url(view_func=view_directory,

Patch:
patch: @@ -980,7 +980,7 @@ def nav_path(request):
     path_parts.append(part)
     is_last = len(path_parts) == len(request.path_parts)
 
-    item = _item(name=part, href=None)
+    item = _item(name=request.server.escape(part), href=None)
 
     if not is_last or (is_dir and request.view_func is not view_directory):
       item.href = request.get_url(view_func=view_directory,
path: lib/viewvc.py
Vulnerability: The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel through 4.9.9 allows attackers to cause a denial of service (system crash) via (1) an application that makes crafted system calls or possibly (2) IPv4 traffic with invalid IP options.
Vulnerability ID: CVE-2017-5970
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2017-02-14
File: net/ipv4/ip_sockglue.c
Commit message: ipv4: keep skb->dst around in presence of IP options

Andrey Konovalov got crashes in __ip_options_echo() when a NULL skb->dst
is accessed.

ipv4_pktinfo_prepare() should not drop the dst if (evil) IP options
are present.

We could refine the test to the presence of ts_needtime or srr,
but IP options are not often used, so let's be conservative.

Thanks to syzkaller team for finding this bug.

Fixes: d826eb14ecef ("ipv4: PKTINFO doesnt need dst reference")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Eric Dumazet

Vulnerable version (before fix):
 void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb) 		pktinfo->ipi_ifindex = 0; 		pktinfo->ipi_spec_dst.s_addr = 0; 	} 	skb_dst_drop(skb); }  int ip_setsockopt(struct sock *sk, int level,

Fixed version (after fix):
 void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb) 		pktinfo->ipi_ifindex = 0; 		pktinfo->ipi_spec_dst.s_addr = 0; 	} 	/* We need to keep the dst for __ip_options_echo() 	 * We could restrict the test to opt.ts_needtime || opt.srr, 	 * but the following is good enough as IP options are not often used. 	 */ 	if (unlikely(IPCB(skb)->opt.optlen)) 		skb_dst_force(skb); 	else 		skb_dst_drop(skb); }  int ip_setsockopt(struct sock *sk, int level,

Patch:
patch: @@ -1238,7 +1238,14 @@ void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb)
 		pktinfo->ipi_ifindex = 0;
 		pktinfo->ipi_spec_dst.s_addr = 0;
 	}
-	skb_dst_drop(skb);
+	/* We need to keep the dst for __ip_options_echo()
+	 * We could restrict the test to opt.ts_needtime || opt.srr,
+	 * but the following is good enough as IP options are not often used.
+	 */
+	if (unlikely(IPCB(skb)->opt.optlen))
+		skb_dst_force(skb);
+	else
+		skb_dst_drop(skb);
 }
 
 int ip_setsockopt(struct sock *sk, int level,
path: net/ipv4/ip_sockglue.c
Vulnerability: Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel before 4.9.11 allows local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state.
Vulnerability ID: CVE-2017-5986
CWE: CWE-362
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2017-02-18
File: net/sctp/socket.c
Commit message: sctp: avoid BUG_ON on sctp_wait_for_sndbuf

Alexander Popov reported that an application may trigger a BUG_ON in
sctp_wait_for_sndbuf if the socket tx buffer is full, a thread is
waiting on it to queue more data and meanwhile another thread peels off
the association being used by the first thread.

This patch replaces the BUG_ON call with a proper error handling. It
will return -EPIPE to the original sendmsg call, similarly to what would
have been done if the association wasn't found in the first place.

Acked-by: Alexander Popov <alex.popov@linux.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Marcelo Ricardo Leitner

Vulnerable version (before fix):
 static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, 		 */ 		release_sock(sk); 		current_timeo = schedule_timeout(current_timeo); 		BUG_ON(sk != asoc->base.sk); 		lock_sock(sk);  		*timeo_p = current_timeo;

Fixed version (after fix):
 static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, 		 */ 		release_sock(sk); 		current_timeo = schedule_timeout(current_timeo); 		if (sk != asoc->base.sk) 			goto do_error; 		lock_sock(sk);  		*timeo_p = current_timeo;

Patch:
patch: @@ -7426,7 +7426,8 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
 		 */
 		release_sock(sk);
 		current_timeo = schedule_timeout(current_timeo);
-		BUG_ON(sk != asoc->base.sk);
+		if (sk != asoc->base.sk)
+			goto do_error;
 		lock_sock(sk);
 
 		*timeo_p = current_timeo;
path: net/sctp/socket.c
Vulnerability: The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allows local users to obtain root privileges or cause a denial of service (double free) via an application that makes an IPV6_RECVPKTINFO setsockopt system call.
Vulnerability ID: CVE-2017-6074
CWE: CWE-415
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2017-02-18
File: net/dccp/input.c
Commit message: dccp: fix freeing skb too early for IPV6_RECVPKTINFO

In the current DCCP implementation an skb for a DCCP_PKT_REQUEST packet
is forcibly freed via __kfree_skb in dccp_rcv_state_process if
dccp_v6_conn_request successfully returns.

However, if IPV6_RECVPKTINFO is set on a socket, the address of the skb
is saved to ireq->pktopts and the ref count for skb is incremented in
dccp_v6_conn_request, so skb is still in use. Nevertheless, it gets freed
in dccp_rcv_state_process.

Fix by calling consume_skb instead of doing goto discard and therefore
calling __kfree_skb.

Similar fixes for TCP:

fb7e2399ec17f1004c0e0ccfd17439f8759ede01 [TCP]: skb is unexpectedly freed.
0aea76d35c9651d55bbaf746e7914e5f9ae5a25d tcp: SYN packets are now
simply consumed

Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Andrey Konovalov

Vulnerable version (before fix):
 int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb, 			if (inet_csk(sk)->icsk_af_ops->conn_request(sk, 								    skb) < 0) 				return 1; 			goto discard; 		} 		if (dh->dccph_type == DCCP_PKT_RESET) 			goto discard;

Fixed version (after fix):
 int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb, 			if (inet_csk(sk)->icsk_af_ops->conn_request(sk, 								    skb) < 0) 				return 1; 			consume_skb(skb); 			return 0; 		} 		if (dh->dccph_type == DCCP_PKT_RESET) 			goto discard;

Patch:
patch: @@ -606,7 +606,8 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
 			if (inet_csk(sk)->icsk_af_ops->conn_request(sk,
 								    skb) < 0)
 				return 1;
-			goto discard;
+			consume_skb(skb);
+			return 0;
 		}
 		if (dh->dccph_type == DCCP_PKT_RESET)
 			goto discard;
path: net/dccp/input.c
Vulnerability: An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapi_attr.c:mapi_attr_read(). These might lead to invalid read and write operations, controlled by an attacker.
Vulnerability ID: CVE-2017-6307
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/verdammelt/tnef
Published: 2017-02-24
File: src/mapi_attr.c
Commit message: Use asserts on lengths to prevent invalid reads/writes.
Commit author: Eric Sesterhenn

Vulnerable version (before fix):
 mapi_attr_read (size_t len, unsigned char *buf)     uint32 i,j;     assert(len > 4);     uint32 num_properties = GETINT32(buf+idx);     MAPI_Attr** attrs = CHECKED_XMALLOC (MAPI_Attr*, (num_properties + 1));      idx += 4; mapi_attr_read (size_t len, unsigned char *buf) 		    /* read the data into a buffer */ 		    a->names[i].data  			= CHECKED_XMALLOC(unsigned char, a->names[i].len); 		    for (j = 0; j < (a->names[i].len >> 1); j++) 			a->names[i].data[j] = (buf+idx)[j*2];  mapi_attr_read (size_t len, unsigned char *buf) 	    case szMAPI_BINARY: 		CHECKINT32(idx, len); v->len = GETINT32(buf+idx); idx += 4;  		if (a->type == szMAPI_UNICODE_STRING) 		{ 		    v->data.buf = (unsigned char*)unicode_to_utf8(v->len, buf+idx); 		} 		else

Fixed version (after fix):
 mapi_attr_read (size_t len, unsigned char *buf)     uint32 i,j;     assert(len > 4);     uint32 num_properties = GETINT32(buf+idx);     assert((num_properties+1) != 0);     MAPI_Attr** attrs = CHECKED_XMALLOC (MAPI_Attr*, (num_properties + 1));      idx += 4; mapi_attr_read (size_t len, unsigned char *buf) 		    /* read the data into a buffer */ 		    a->names[i].data  			= CHECKED_XMALLOC(unsigned char, a->names[i].len); 		    assert((idx+(a->names[i].len*2)) <= len); 		    for (j = 0; j < (a->names[i].len >> 1); j++) 			a->names[i].data[j] = (buf+idx)[j*2];  mapi_attr_read (size_t len, unsigned char *buf) 	    case szMAPI_BINARY: 		CHECKINT32(idx, len); v->len = GETINT32(buf+idx); idx += 4;  		assert(v->len + idx <= len);  		if (a->type == szMAPI_UNICODE_STRING) 		{ 		    assert(v->len != 0); 		    v->data.buf = (unsigned char*)unicode_to_utf8(v->len, buf+idx); 		} 		else

Patch:
patch: @@ -174,6 +174,7 @@ mapi_attr_read (size_t len, unsigned char *buf)
     uint32 i,j;
     assert(len > 4);
     uint32 num_properties = GETINT32(buf+idx);
+    assert((num_properties+1) != 0);
     MAPI_Attr** attrs = CHECKED_XMALLOC (MAPI_Attr*, (num_properties + 1));
 
     idx += 4;
@@ -212,6 +213,7 @@ mapi_attr_read (size_t len, unsigned char *buf)
 		    /* read the data into a buffer */
 		    a->names[i].data 
 			= CHECKED_XMALLOC(unsigned char, a->names[i].len);
+		    assert((idx+(a->names[i].len*2)) <= len);
 		    for (j = 0; j < (a->names[i].len >> 1); j++)
 			a->names[i].data[j] = (buf+idx)[j*2];
 
@@ -308,8 +310,11 @@ mapi_attr_read (size_t len, unsigned char *buf)
 	    case szMAPI_BINARY:
 		CHECKINT32(idx, len); v->len = GETINT32(buf+idx); idx += 4;
 
+		assert(v->len + idx <= len);
+
 		if (a->type == szMAPI_UNICODE_STRING)
 		{
+		    assert(v->len != 0);
 		    v->data.buf = (unsigned char*)unicode_to_utf8(v->len, buf+idx);
 		}
 		else
path: src/mapi_attr.c
Vulnerability: The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted DEX file.
Vulnerability ID: CVE-2017-6319
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/radare/radare2
Published: 2017-03-02
File: libr/bin/p/bin_dex.c
Commit message: Fix #6836 - oob write in dex
Commit author: pancake

Vulnerable version (before fix):
 static void dex_parse_debug_item(RBinFile *binfile, RBinDexObj *bin, 	ut64 source_file_idx = c->source_file; 	RList *params, *debug_positions, *emitted_debug_locals = NULL;  	bool keep = true; 	if (argReg >= regsz) { 		//return; // this return breaks tests 	} 	p4 = r_uleb128 (p4, p4_end - p4, &line_start); 	p4 = r_uleb128 (p4, p4_end - p4, &parameters_size);

Fixed version (after fix):
 static void dex_parse_debug_item(RBinFile *binfile, RBinDexObj *bin, 	ut64 source_file_idx = c->source_file; 	RList *params, *debug_positions, *emitted_debug_locals = NULL;  	bool keep = true; 	if (argReg > regsz) { 		return; // this return breaks tests 	} 	p4 = r_uleb128 (p4, p4_end - p4, &line_start); 	p4 = r_uleb128 (p4, p4_end - p4, &parameters_size);

Patch:
patch: @@ -309,8 +309,8 @@ static void dex_parse_debug_item(RBinFile *binfile, RBinDexObj *bin,
 	ut64 source_file_idx = c->source_file;
 	RList *params, *debug_positions, *emitted_debug_locals = NULL; 
 	bool keep = true;
-	if (argReg >= regsz) {
-		//return; // this return breaks tests
+	if (argReg > regsz) {
+		return; // this return breaks tests
 	}
 	p4 = r_uleb128 (p4, p4_end - p4, &line_start);
 	p4 = r_uleb128 (p4, p4_end - p4, &parameters_size);
path: libr/bin/p/bin_dex.c
Vulnerability: The ip_cmsg_recv_checksum function in net/ipv4/ip_sockglue.c in the Linux kernel before 4.10.1 has incorrect expectations about skb data layout, which allows local users to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted system calls, as demonstrated by use of the MSG_MORE flag in conjunction with loopback UDP transmission.
Vulnerability ID: CVE-2017-6347
CWE: CWE-125
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2017-03-01
File: net/ipv4/ip_sockglue.c
Commit message: ip: fix IP_CHECKSUM handling

The skbs processed by ip_cmsg_recv() are not guaranteed to
be linear e.g. when sending UDP packets over loopback with
MSGMORE.
Using csum_partial() on [potentially] the whole skb len
is dangerous; instead be on the safe side and use skb_checksum().

Thanks to syzkaller team to detect the issue and provide the
reproducer.

v1 -> v2:
 - move the variable declaration in a tighter scope

Fixes: ad6f939ab193 ("ip: Add offset parameter to ip_cmsg_recv")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Paolo Abeni

Vulnerable version (before fix):
 static void ip_cmsg_recv_checksum(struct msghdr *msg, struct sk_buff *skb, 	if (skb->ip_summed != CHECKSUM_COMPLETE) 		return;  	if (offset != 0) 		csum = csum_sub(csum, 				csum_partial(skb_transport_header(skb) + tlen, 					     offset, 0));  	put_cmsg(msg, SOL_IP, IP_CHECKSUM, sizeof(__wsum), &csum); }

Fixed version (after fix):
 static void ip_cmsg_recv_checksum(struct msghdr *msg, struct sk_buff *skb, 	if (skb->ip_summed != CHECKSUM_COMPLETE) 		return;  	if (offset != 0) { 		int tend_off = skb_transport_offset(skb) + tlen; 		csum = csum_sub(csum, skb_checksum(skb, tend_off, offset, 0)); 	}  	put_cmsg(msg, SOL_IP, IP_CHECKSUM, sizeof(__wsum), &csum); }

Patch:
patch: @@ -116,10 +116,10 @@ static void ip_cmsg_recv_checksum(struct msghdr *msg, struct sk_buff *skb,
 	if (skb->ip_summed != CHECKSUM_COMPLETE)
 		return;
 
-	if (offset != 0)
-		csum = csum_sub(csum,
-				csum_partial(skb_transport_header(skb) + tlen,
-					     offset, 0));
+	if (offset != 0) {
+		int tend_off = skb_transport_offset(skb) + tlen;
+		csum = csum_sub(csum, skb_checksum(skb, tend_off, offset, 0));
+	}
 
 	put_cmsg(msg, SOL_IP, IP_CHECKSUM, sizeof(__wsum), &csum);
 }
path: net/ipv4/ip_sockglue.c