Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 3 Nov 2010 18:19:56 -0400
From: Dan Rosenberg <dan.j.rosenberg@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: kernel: CAN information leak

The CAN protocol uses the address of a kernel heap object as a proc
filename, revealing information that could be useful during
exploitation.

The below post also mentions a heap overflow.  While there is a
semantic overflow (17 bytes being copied into a 9-byte buffer), in
reality, the object whose member is being overflowed resides in a
kernel heap slab cache that includes enough padding that there is no
possible corruption.  So, it's a bug but not a vulnerability.

Reference:
http://marc.info/?l=linux-netdev&m=128872251418192&w=2

-Dan

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.