Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 21 Sep 2010 12:41:25 +0800
From: Eugene Teo <eugene@...hat.com>
To: oss-security@...ts.openwall.com
CC: Dan Rosenberg <dan.j.rosenberg@...il.com>,
        "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: kernel: Heap corruption in ROSE

On 09/21/2010 12:25 PM, Dan Rosenberg wrote:
> When binding a ROSE socket, the "srose_ndigis" field of the
> user-provided sockaddr_rose struct is intended to be restricted to
> less than ROSE_MAX_DIGIS.  However, since this field is a signed
> integer, this check will pass when provided with a negative value,
> allowing the "source_ndigis" field of the rose_sock struct (which is
> an unsigned char) to be set to arbitrary values.  Then, by calling a
> function such as rose_getname(), heap corruption results, since this
> field is used as a maximum index to read from and write into an array
> of ROSE_MAX_DIGIS size.  This can only be triggered by unprivileged
> users when a ROSE device (e.g. rose0) exists.
>
> Reference (and fix):
> http://marc.info/?l=linux-netdev&m=128502238927086&w=2

Please use CVE-2010-3310.

Thanks, Eugene
-- 
main(i) { putchar(182623909 >> (i-1) * 5&31|!!(i<7)<<6) && main(++i); }

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.