Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 07 May 2012 10:44:46 +0200
From: Timo Warns <>
Subject: CVE request: Linux kernel: Buffer overflow in HFS plus filesystem

The Linux kernel (at least 3.x <= 3.3.4 and 2.6.x <= contains
a vulnerability in the driver for HFS plus file systems that may be
exploited for code execution or privilege escalation.

A specially-crafted HFS plus filesystem can cause a buffer overflow via
the memcpy() call of hfs_bnode_read() (in fs/hfsplus/bnode.c). The functions

	hfsplus_rename_cat() (in fs/hfsplus/catalog.c) and
	hfsplus_readdir() (in fs/hfsplus/dir.c)

call hfs_bnode_read() with values that result in a memcpy() call with a
fixed-length destination buffer and both, a source buffer and length,
that are read from the filesystem without sufficient validation.

The buffer overflows were previously fixed in the HFS filesystem driver
and have been assigned CVE-2009-4020 (commit
ec81aecb29668ad71f699f4e7b96ec46691895b6 [1]).
Commit 6f24f892871acc47b40dd594c63606a17c714f77 ("hfsplus: fix a
potential buffer overflow") [2] also fixes the issue in the HFS plus
filesystem driver.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.