oss-security - Re: CVE request - kernel: xfs swapext ioctl issue

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 18 Jun 2010 11:27:15 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request - kernel: xfs swapext ioctl issue

Please use CVE-2010-2226 for this.

Thanks.

-- 
    JB


----- "Eugene Teo" <eugeneteo@...nel.sg> wrote:

> User "foo" can use the SWAPEXT ioctl to swap a write-only file owned
> by 
> user "bar" into a file owned by "foo" and subsequently reading it. It
> 
> does so by checking that the file descriptors passed to the ioctl are
> 
> also opened for reading.
> 
> References:
> https://bugzilla.redhat.com/show_bug.cgi?id=605158
> http://archives.free.net.ph/message/20100616.130710.301704aa.en.html
> http://archives.free.net.ph/message/20100616.135735.40f53a32.en.html
> 
> Thanks, Eugene
> -- 
> main(i) { putchar(182623909 >> (i-1) * 5&31|!!(i<7)<<6) && main(++i);
> }

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.