Date: Mon, 07 May 2012 10:44:46 +0200 From: Timo Warns <warns@...-sense.de> To: oss-security@...ts.openwall.com Subject: CVE request: Linux kernel: Buffer overflow in HFS plus filesystem The Linux kernel (at least 3.x <= 3.3.4 and 2.6.x <= 18.104.22.168) contains a vulnerability in the driver for HFS plus file systems that may be exploited for code execution or privilege escalation. A specially-crafted HFS plus filesystem can cause a buffer overflow via the memcpy() call of hfs_bnode_read() (in fs/hfsplus/bnode.c). The functions hfsplus_rename_cat() (in fs/hfsplus/catalog.c) and hfsplus_readdir() (in fs/hfsplus/dir.c) call hfs_bnode_read() with values that result in a memcpy() call with a fixed-length destination buffer and both, a source buffer and length, that are read from the filesystem without sufficient validation. The buffer overflows were previously fixed in the HFS filesystem driver and have been assigned CVE-2009-4020 (commit ec81aecb29668ad71f699f4e7b96ec46691895b6 ). Commit 6f24f892871acc47b40dd594c63606a17c714f77 ("hfsplus: fix a potential buffer overflow")  also fixes the issue in the HFS plus filesystem driver.  http://git.kernel.org/linus/ec81aecb29668ad71f699f4e7b96ec46691895b6  http://git.kernel.org/linus/6f24f892871acc47b40dd594c63606a17c714f77
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.