Date: Thu, 6 Jan 2011 09:18:11 -0700 From: dann frazier <dannf@...nf.org> To: Ben Hutchings <ben@...adent.org.uk>, "Steven M. Christey" <coley@...us.mitre.org> Cc: Debian kernel maintainers <debian-kernel@...ts.debian.org>, stable-review@...nel.org, oss-security@...ts.openwall.com Subject: CVE Request: kernel [Re: Security review of 22.214.171.124] On Thu, Jan 06, 2011 at 01:05:47AM +0000, Ben Hutchings wrote: > These are the patches that looked security-relevant, from a fairly quick > review: Thanks for the review Ben! Steve, can you assign CVEs for the following issues? > [03/49] fuse: verify ioctl retries > Kernel buffer overflow, but only CUSE servers could exploit it and > /dev/cuse is normally restricted to root. Upstream fix: http://git.kernel.org/linus/7572777eef78ebdee1ecb7c258c0ef94d35bad16 Introduced in 2.6.29. > [16/49] IB/uverbs: Handle large number of entries in poll CQ > Fixes integer overflow and information leak which I assume can be triggered > by unprivileged local users. Sounds like it - Documentation/infiniband/user_verbs.txt says: "Since the InfiniBand userspace verbs should be safe for use by non-privileged processes, it may be useful to add an appropriate MODE or GROUP to the udev rule." Upstream fix: http://git.kernel.org/linus/7182afea8d1afd432a17c18162cc3fd441d0da93 Introduced in 2.6.15. > [20/49] orinoco: fix TKIP countermeasure behaviour > Fixes cryptographic weakness potentially leaking information to remote > (but physically nearby) users. Upstream fix: http://git.kernel.org/linus/0a54917c3fc295cb61f3fb52373c173fd3b69f48 Introduced in 2.6.28. > [24/49] tracing: Fix panic when lseek() called on "trace" opened for writing > File is normally only writable by root, so not a security issue. ack > [33/49] [SCSI] bfa: fix system crash when reading sysfs fc_host statistics > Local denial-of-service. > CVE-2010-4343 > > [36/49] install_special_mapping skips security_file_mmap check. > May enable privilege escalation through null pointer bugs that would > otherwise only cause denial-of-service. > CVE-2010-4346 > > [42/49] sound: Prevent buffer overflow in OSS load_mixer_volumes > Not relevant to Debian kernel images since we don't build OSS. > CVE-2010-4257 > > [44/49] ima: fix add LSM rule bug > Allows subversion of IMA. Not relevant to Debian kernel images since we > don't build IMA. Upstream fix: http://git.kernel.org/linus/867c20265459d30a01b021a9c1e81fb4c5832aa9 Introoduced in 2.6.30. > [48/49] sctp: Fix a race between ICMP protocol unreachable and connect() > Remote denial-of-service. > CVE-2010-4526 > > Ben. >
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.