oss-security - Re: CVE request: kernel: flat: fix uninitialized ptr with shared libs

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Tue, 18 Aug 2009 14:32:49 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: kernel: flat: fix uninitialized ptr
 with shared libs

Use CVE-2009-2845, to be filled in soon.

On Thu, 13 Aug 2009, Eugene Teo wrote:

> The new credentials code broke load_flat_shared_library() as it now uses
> an uninitialised cred pointer, leading to a NULL pointer dereference.
> This can be triggered by running a shared flat binary.
>
> kernel/cred.c was introduced in v2.6.29-rc1 IIRC.
>
> Upstream commit:
> http://git.kernel.org/linus/3440625d78711bee41a84cf29c3d8c579b522666
>
> References:
> http://lkml.org/lkml/2009/6/22/91
> http://thread.gmane.org/gmane.linux.hardware.blackfin.kernel.devel/1905
>
> Thanks, Eugene
>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.