Date: Wed, 10 Nov 2010 14:31:25 -0500 (EST) From: Josh Bressers <bressers@...hat.com> To: oss-security@...ts.openwall.com, Petr Matousek <pmatouse@...hat.com> Cc: coley@...us.mitre.org Subject: Re: CVE request: kernel: gdth: integer overflow in ioc_general() Please use CVE-2010-4157 Thanks. -- JB ----- "Petr Matousek" <pmatouse@...hat.com> wrote: > "gdth_ioctl_alloc() takes the size variable as an int. > copy_from_user() takes the size variable as an unsigned long. > gen.data_len and gen.sense_len are unsigned longs. > On x86_64 longs are 64 bit and ints are 32 bit. > > We could pass in a very large number and the allocation would > truncate > the size to 32 bits and allocate a small buffer. Then when we do the > copy_from_user(), it would result in a memory corruption." > > Upstream commit: > http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=f63ae56e4e97fb12053590e41a4fa59e7daa74a4 > > Credit: James E.J. Bottomley > > Reference: > http://ns3.spinics.net/lists/linux-scsi/msg47361.html > https://bugzilla.redhat.com/show_bug.cgi?id=651147 > > Thanks, > -- > Petr Matousek / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.