)]}'
{
  "commit": "c4acc0748bb3769f9fbcec280b103779d78ca68e",
  "tree": "bcdd10bb0fc0025830fbf9780395840a75760ffb",
  "parents": [
    "5d4ffd91281840f7a118143d77fbefb02e87943c"
  ],
  "author": {
    "name": "Or Cohen",
    "email": "orcohen@paloaltonetworks.com",
    "time": "Sun Aug 30 20:04:51 2020 +0300"
  },
  "committer": {
    "name": "Vaibhav Rustagi",
    "email": "vaibhavrustagi@google.com",
    "time": "Fri Sep 04 01:51:43 2020 +0000"
  },
  "message": "net/packet: fix overflow in tpacket_rcv\n\nUsing tp_reserve to calculate netoff can overflow as\ntp_reserve is unsigned int and netoff is unsigned short.\n\nThis may lead to macoff receving a smaller value then\nsizeof(struct virtio_net_hdr), and if po-\u003ehas_vnet_hdr\nis set, an out-of-bounds write will occur when\ncalling virtio_net_hdr_from_skb.\n\nThe bug is fixed by converting netoff to unsigned int\nand checking if it exceeds USHRT_MAX.\n\nBUG\u003db/167730744\nTEST\u003dManually tried the reproducer before and after this fix.\nRELEASE_NOTE\u003dFixed overflow in tpacket_rcv, which caused\nCVE-2020-14386.\nSOURCE\u003dFROMLIST(https://www.openwall.com/lists/oss-security/2020/09/03/3)\n\nFixes: 8913336a7e8d (\"packet: add PACKET_RESERVE sockopt\")\nSigned-off-by: Or Cohen \u003corcohen@paloaltonetworks.com\u003e\nSigned-off-by: Roy Yang \u003croyyang@google.com\u003e\nChange-Id: I119b9e950f948259bbf0e3afeda5f33c0fb40e51\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/4981\nReviewed-by: Vaibhav Rustagi \u003cvaibhavrustagi@google.com\u003e\nReviewed-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\nTested-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/4984\nTested-by: Vaibhav Rustagi \u003cvaibhavrustagi@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "ecea8edae61c1c03e97d3a2e41b8bd3a4227b277",
      "old_mode": 33188,
      "old_path": "net/packet/af_packet.c",
      "new_id": "466c58ccbce40964757c9ec8b305e0c5f5e47784",
      "new_mode": 33188,
      "new_path": "net/packet/af_packet.c"
    }
  ]
}