Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 10 Nov 2010 18:09:39 -0500
From: Dan Rosenberg <>
Subject: CVE request: kernel: Multiple DoS issues in block layer

A series of fixes were committed to address several issues I reported
in the block layer.  These issues require the ability to send device
ioctls to a SCSI device, which is typically possible for users with
group 'cdrom' or similar.

1. Due to integer underflow and overflow issues when determining the
number of pages required for maliciously crafted I/O requests, a local
user could send a device ioctl that results in the sequential
allocation of a very large number of pages, causing the OOM killer to
be invoked and crashing the system:;a=commit;h=cb4644cac4a2797afc847e6c92736664d4b0ea34

2. By submitting certain I/O requests with 0 length, a local user
could cause a kernel panic:;a=commit;h=9284bcf4e335e5f18a8bc7b26461c33ab60d0689

In addition to the fixes for these identified issues, there were also
patches committed for improved sanity checking on I/O requests, and
checks to prevent integer overflows in heap allocation sizes.  In my
testing, I wasn't able to exploit these issues, so just FYI:;a=commit;h=9f864c80913467312c7b8690e41fb5ebd1b50e92;a=commit;h=f3f63c1c28bc861a931fac283b5bc3585efb8967


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.