oss-security - CVE request: kernel: parisc: isa-eeprom missing lower bound check

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [thread-next>] [month] [year] [list]

Date: Mon, 10 Aug 2009 12:40:20 +0800
From: Eugene Teo <eugeneteo@...nel.sg>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>
Subject: CVE request: kernel: parisc: isa-eeprom missing lower bound check

loff_t is a signed type. If userspace passes a negative ppos, the
"count" range check is weakened. If ppos is negative, the readb() later
in the function will poke in random memory. Only affects if you are
using a PA-RISC kernel with CONFIG_EISA set.

Upstream commit:
http://git.kernel.org/linus/6b4dbcd86a9d464057fcc7abe4d0574093071fcc

Reference:
http://patchwork.kernel.org/patch/36418/

Thanks, Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.