Mathias Krause 276bdb82de dccp: check ccid before dereferencing
ccid_hc_rx_getsockopt() and ccid_hc_tx_getsockopt() might be called with
a NULL ccid pointer leading to a NULL pointer dereference. This could
lead to a privilege escalation if the attacker is able to map page 0 and
prepare it with a fake ccid_ops pointer.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Cc: stable@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-08-15 21:36:31 -07:00
..
2012-08-15 21:36:30 -07:00
2012-07-10 22:36:17 +02:00
2012-07-19 10:48:00 -07:00
2012-08-14 14:45:07 -07:00
2012-07-19 10:48:00 -07:00
2012-07-16 23:23:52 -07:00
2012-06-15 15:30:15 -07:00
2012-04-15 12:44:40 -04:00
2012-05-17 18:45:20 -04:00
2012-08-15 21:36:31 -07:00
2012-07-23 01:01:44 -07:00