Date: Mon, 15 Sep 2014 13:20:09 -0400 (EDT) From: cve-assign@...re.org To: meissner@...e.de Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE Request: libceph auth token overflow / Linux kernel -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c27a3e4d667fdcad3db7b104f75659478e0c68d8 > http://tracker.ceph.com/issues/8979 Bug 8979 says "about 1 month ago ... pushed wip-8979 which removes the fixed buffer size. but, we still need to make things not crash when the auth reply processing fails. that could still happen if we get a huge ticket (>4k) and kmalloc fails on a large page size. or the auth reply from the mon is simply not understood by the client." This apparently has multiple known vulnerability types. Use CVE-2014-6416 for the buffer overflow. Use CVE-2014-6417 for the issue of incorrect handling of kmalloc failures. Use CVE-2014-6418 for ths missing validation of the auth reply. Our guess is that c27a3e4d667fdcad3db7b104f75659478e0c68d8 is intended to address all three of these crash issues, but additional CVE IDs might be needed if there were an incomplete fix. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJUFx92AAoJEKllVAevmvmspFUH/RHfrkakYAUwmoN3qgGKC1La KiKgvljZn4WUt7p5pMQyb1FYIjMF7vIEdV2GR5hdG+gec0wVjlyw7SfLPvwXIjO+ KykcaXfHIp4IMJ0/62FFVeZbB6izU4Qgep0a27ynBCg0+vhfIOuiyLfgiVL5IfES HqUXdUyxvRL+1e+TyMweQQezEDJL5FLc5YUU8kwRhSydDLOdjMjIWY5KvKYp3xyo ETG6HHwFzQaHu8ty9Hyx3oLDVH113nE5gUbjG4kI5MjaLcCq8zer+cE57YCEnOBu eOmrs4An/CZhuGho0ThYFr1G4N821af8ycPb1kts5h7u2e4SycFYG0k9N7/UN68= =XnWo -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ