Date: Fri, 01 Jul 2011 16:55:17 +0800 From: Eugene Teo <eugene@...hat.com> To: oss-security@...ts.openwall.com, "Steven M. Christey" <coley@...us.mitre.org> Subject: Re: CVE request: kernel: nl80211: missing check for valid SSID size in scan operations On 07/01/2011 04:48 PM, Petr Matousek wrote: > In both trigger_scan and sched_scan operations, we were checking for the > SSID length before assigning the value correctly. Since the memory was > just kzalloc'ed, the check was always failing and SSID with over 32 > characters were allowed to go through. > > This is causing a buffer overflow when copying the actual SSID to the > proper place. > > Please note that it needs CAP_NET_ADMIN privileges. > > Upstream commits: > 208c72f4fe44fe09577e7975ba0e7fa0278f3d03 > 57a27e1d6a3bb9ad4efeebd3a8c71156d6207536 > > References: > https://bugzilla.redhat.com/show_bug.cgi?id=718152 Use CVE-2011-2517. Eugene
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.