)]}'
{
  "commit": "ecd7918745234e423dd87fcc0c077da557909720",
  "tree": "7435863b7aa3822b3c927264c5cb00da7783896b",
  "parents": [
    "1f86840f897717f86d523a13e99a447e6a5d2fa5"
  ],
  "author": {
    "name": "Mathias Krause",
    "email": "minipli@googlemail.com",
    "time": "Thu Sep 20 10:01:49 2012 +0000"
  },
  "committer": {
    "name": "David S. Miller",
    "email": "davem@davemloft.net",
    "time": "Thu Sep 20 18:08:40 2012 -0400"
  },
  "message": "xfrm_user: ensure user supplied esn replay window is valid\n\nThe current code fails to ensure that the netlink message actually\ncontains as many bytes as the header indicates. If a user creates a new\nstate or updates an existing one but does not supply the bytes for the\nwhole ESN replay window, the kernel copies random heap bytes into the\nreplay bitmap, the ones happen to follow the XFRMA_REPLAY_ESN_VAL\nnetlink attribute. This leads to following issues:\n\n1. The replay window has random bits set confusing the replay handling\n   code later on.\n\n2. A malicious user could use this flaw to leak up to ~3.5kB of heap\n   memory when she has access to the XFRM netlink interface (requires\n   CAP_NET_ADMIN).\n\nKnown users of the ESN replay window are strongSwan and Steffen\u0027s\niproute2 patch (\u003chttp://patchwork.ozlabs.org/patch/85962/\u003e). The latter\nuses the interface with a bitmap supplied while the former does not.\nstrongSwan is therefore prone to run into issue 1.\n\nTo fix both issues without breaking existing userland allow using the\nXFRMA_REPLAY_ESN_VAL netlink attribute with either an empty bitmap or a\nfully specified one. For the former case we initialize the in-kernel\nbitmap with zero, for the latter we copy the user supplied bitmap. For\nstate updates the full bitmap must be supplied.\n\nTo prevent overflows in the bitmap length calculation the maximum size\nof bmp_len is limited to 128 by this patch -- resulting in a maximum\nreplay window of 4096 packets. This should be sufficient for all real\nlife scenarios (RFC 4303 recommends a default replay window size of 64).\n\nCc: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nCc: Martin Willi \u003cmartin@revosec.ch\u003e\nCc: Ben Hutchings \u003cbhutchings@solarflare.com\u003e\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "22e61fdf75a2bd46a656e164e046a006acd43343",
      "old_mode": 33188,
      "old_path": "include/linux/xfrm.h",
      "new_id": "28e493b5b94c9ba6d946d728a0908c84e34294db",
      "new_mode": 33188,
      "new_path": "include/linux/xfrm.h"
    },
    {
      "type": "modify",
      "old_id": "8024b3dea8c2d824d1e37a3cf5f51401cb586b47",
      "old_mode": 33188,
      "old_path": "net/xfrm/xfrm_user.c",
      "new_id": "5927065e97cf9747965475175f268311e616ec82",
      "new_mode": 33188,
      "new_path": "net/xfrm/xfrm_user.c"
    }
  ]
}