)]}'
{
  "commit": "2ee4efad26bd9d6c30d82944a106eaa20854967b",
  "tree": "8bab123fbc0045c7fb88e211a4b1b639d1651c09",
  "parents": [
    "f3d4a28d6b04a73d713c42ccb874194336d8c32d"
  ],
  "author": {
    "name": "Or Cohen",
    "email": "orcohen@paloaltonetworks.com",
    "time": "Sun Aug 30 20:04:51 2020 +0300"
  },
  "committer": {
    "name": "Vaibhav Rustagi",
    "email": "vaibhavrustagi@google.com",
    "time": "Fri Sep 04 01:51:16 2020 +0000"
  },
  "message": "net/packet: fix overflow in tpacket_rcv\n\nUsing tp_reserve to calculate netoff can overflow as\ntp_reserve is unsigned int and netoff is unsigned short.\n\nThis may lead to macoff receving a smaller value then\nsizeof(struct virtio_net_hdr), and if po-\u003ehas_vnet_hdr\nis set, an out-of-bounds write will occur when\ncalling virtio_net_hdr_from_skb.\n\nThe bug is fixed by converting netoff to unsigned int\nand checking if it exceeds USHRT_MAX.\n\nBUG\u003db/167730744\nTEST\u003dManually tried the reproducer before and after this fix.\nRELEASE_NOTE\u003dFixed overflow in tpacket_rcv, which caused\nCVE-2020-14386.\nSOURCE\u003dFROMLIST(https://www.openwall.com/lists/oss-security/2020/09/03/3)\n\nFixes: 8913336a7e8d (\"packet: add PACKET_RESERVE sockopt\")\nSigned-off-by: Or Cohen \u003corcohen@paloaltonetworks.com\u003e\nSigned-off-by: Roy Yang \u003croyyang@google.com\u003e\nChange-Id: I119b9e950f948259bbf0e3afeda5f33c0fb40e51\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/4981\nReviewed-by: Vaibhav Rustagi \u003cvaibhavrustagi@google.com\u003e\nReviewed-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\nTested-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\n(cherry picked from commit 4d64e87ddd30cd19fb16caaae5cc3fc81a135e16)\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/4982\nTested-by: Vaibhav Rustagi \u003cvaibhavrustagi@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "1d63ab3a878a813371df3b7565d6470476d69bed",
      "old_mode": 33188,
      "old_path": "net/packet/af_packet.c",
      "new_id": "56084a16d0f9ad655fd0724d4fae17c0e4b3dedd",
      "new_mode": 33188,
      "new_path": "net/packet/af_packet.c"
    }
  ]
}