[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 1 Mar 2011 10:46:12 -0500 (EST)
From: Petr Matousek <pmatouse@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Vasiliy Kulikov <segoon@...nwall.com>
Subject: Re: CVE request: kernel: two bluetooth and one
ebtables infoleaks/DoSes
> "struct sco_conninfo has one padding byte in the end. Local variable
> cinfo of type sco_conninfo is copied to userspace with this
> uninizialized one byte, leading to old stack contents leak."
>
> https://lkml.org/lkml/2011/2/14/49
Please use CVE-2011-1078.
> "Struct ca is copied from userspace. It is not checked whether the
> "device" field is NULL terminated. This potentially leads to BUG()
> inside of alloc_netdev_mqs() and/or information leak by creating a
> device with a name made of contents of kernel stack."
>
> https://lkml.org/lkml/2011/2/14/50
Please use CVE-2011-1079.
> "Struct tmp is copied from userspace. It is not checked whether the
> "name" field is NULL terminated. This may lead to buffer overflow and
> passing contents of kernel stack as a module name to
> try_then_request_module() and, consequently, to modprobe commandline.
> It would be seen by all userspace processes."
>
> https://lkml.org/lkml/2011/2/14/51
Please use CVE-2011-1080.
Thanks you,
--
Petr Matousek / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
