Date: Tue, 22 Sep 2009 03:21:19 -0400 (EDT) From: "Steven M. Christey" <coley@...us.mitre.org> To: oss-security@...ts.openwall.com cc: "Steven M. Christey" <coley@...us.mitre.org> Subject: Re: CVE request: kernel: NULL pointer dereference in sg_build_indirect() ====================================================== Name: CVE-2009-3288 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3288 Reference: MLIST:[linux-kernel] 20090902 [BUG] 2.6.31-rc8 readcd Oops Reference: URL:http://lkml.org/lkml/2009/9/3/1 Reference: MLIST:[linux-kernel] 20090903 [PATCH] sg: fix oops in the error path in sg_build_indirect() Reference: URL:http://lkml.org/lkml/2009/9/3/107 Reference: MLIST:[oss-security] 20090904 CVE request: kernel: NULL pointer dereference in sg_build_indirect() Reference: URL:http://www.openwall.com/lists/oss-security/2009/09/03/4 The sg_build_indirect function in drivers/scsi/sg.c in Linux kernel 2.6.28-rc1 through 2.6.31-rc8 uses an incorrect variable when accessing an array, which allows local users to cause a denial of service (kernel OOPS and NULL pointer dereference), as demonstrated by using xcdroast to duplicate a CD. NOTE: this is only exploitable by users who can open the cdrom device.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.