oss-security - Re: CVE request: kernel: xfs: XFS_IOC

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 7 Sep 2010 15:33:33 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: kernel: xfs: XFS_IOC_FSGETXATTR
 ioctl memory leak

Please use CVE-2010-3078

Thanks.

-- 
    JB


----- "Eugene Teo" <eugene@...hat.com> wrote:

> From Dan Rosenberg, "the XFS_IOC_FSGETXATTR ioctl allows unprivileged
> 
> users to read 12 bytes of uninitialized stack memory, because the 
> fsxattr struct declared on the stack in xfs_ioc_fsgetxattr() does not
> 
> alter (or zero) the 12-byte fsx_pad member before copying it back to
> the 
> user."
> 
> http://www.linux.sgi.com/archives/xfs-masters/2010-09/msg00002.html
> https://bugzilla.redhat.com/show_bug.cgi?id=630804
> 
> Thanks, Eugene
> -- 
> main(i) { putchar(182623909 >> (i-1) * 5&31|!!(i<7)<<6) && main(++i);
> }

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.