![]() ccid_hc_rx_getsockopt() and ccid_hc_tx_getsockopt() might be called with a NULL ccid pointer leading to a NULL pointer dereference. This could lead to a privilege escalation if the attacker is able to map page 0 and prepare it with a fake ccid_ops pointer. Signed-off-by: Mathias Krause <minipli@googlemail.com> Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk> Cc: stable@vger.kernel.org Signed-off-by: David S. Miller <davem@davemloft.net> |
||
---|---|---|
.. | ||
ccids | ||
ackvec.c | ||
ackvec.h | ||
ccid.c | ||
ccid.h | ||
dccp.h | ||
diag.c | ||
feat.c | ||
feat.h | ||
input.c | ||
ipv4.c | ||
ipv6.c | ||
ipv6.h | ||
Kconfig | ||
Makefile | ||
minisocks.c | ||
options.c | ||
output.c | ||
probe.c | ||
proto.c | ||
qpolicy.c | ||
sysctl.c | ||
timer.c |