[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 22 Sep 2009 03:21:19 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: kernel: NULL pointer dereference in
sg_build_indirect()
======================================================
Name: CVE-2009-3288
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3288
Reference: MLIST:[linux-kernel] 20090902 [BUG] 2.6.31-rc8 readcd Oops
Reference: URL:http://lkml.org/lkml/2009/9/3/1
Reference: MLIST:[linux-kernel] 20090903 [PATCH] sg: fix oops in the error path in sg_build_indirect()
Reference: URL:http://lkml.org/lkml/2009/9/3/107
Reference: MLIST:[oss-security] 20090904 CVE request: kernel: NULL pointer dereference in sg_build_indirect()
Reference: URL:http://www.openwall.com/lists/oss-security/2009/09/03/4
The sg_build_indirect function in drivers/scsi/sg.c in Linux kernel
2.6.28-rc1 through 2.6.31-rc8 uses an incorrect variable when
accessing an array, which allows local users to cause a denial of
service (kernel OOPS and NULL pointer dereference), as demonstrated by
using xcdroast to duplicate a CD. NOTE: this is only exploitable by
users who can open the cdrom device.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
