oss-security - Re: CVE request kernel: tcf_fill_node() infoleak due to typo in 9ef1d4c7

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 15 Oct 2009 07:11:06 +0200
From: Willy Tarreau <w@....eu>
To: Eugene Teo <eugene@...hat.com>
Cc: oss-security@...ts.openwall.com,
        "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request kernel: tcf_fill_node() infoleak due to typo in 9ef1d4c7

On Thu, Oct 15, 2009 at 10:33:15AM +0800, Eugene Teo wrote:
> Eugene Teo wrote:
> >Eugene Teo wrote:
> >>[...]
> >>>  CVE-2005-4881 - tc_fill_qdisc()  (at least)
> >>
> >>This requires http://patchwork.ozlabs.org/patch/35412/ too. There was 
> >>a typo in the upstream commit 9ef1d4c7.
> >
> >I'm not sure but perhaps this needs a new CVE name. This infoleak bug 
> >was introduced in 2005, but was discovered and fixed recently.
> 
> This is assigned with CVE-2009-3612 - incomplete fix for CVE-2005-4881.

and 2.4 has it too since the 2.6 patch applied cleanly.

Thanks,
Willy

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.