Date: Tue, 5 Apr 2011 13:00:28 -0400 From: Dan Rosenberg <dan.j.rosenberg@...il.com> To: oss-security@...ts.openwall.com Subject: CVE request: kernel: two issues in mpt2sas "At two points in handling device ioctls via /dev/mpt2ctl, user-supplied length values are used to copy data from userspace into heap buffers without bounds checking, allowing controllable heap corruption and subsequently privilege escalation. Additionally, user-supplied values are used to determine the size of a copy_to_user() as well as the offset into the buffer to be read, with no bounds checking, allowing users to read arbitrary kernel memory."  These issues require access to the /dev/mpt2sas device (LSI MPT Fusion SAS 2.0). While the kernel creates this device file root-root 660 by default, I've seen it with more open permissions on live systems, so perhaps there's some common use case that requires modifying these default permissions. -Dan  http://marc.info/?l=linux-kernel&m=130202198105756&w=2
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.