Date: Mon, 21 May 2012 08:38:31 +0200 From: Marcus Meissner <meissner@...e.de> To: OSS Security List <oss-security@...ts.openwall.com> Subject: CVE Request: some drm overflow checks Hi, spotted in xorls blog, who spotted it in the kernel stable changelog: https://xorl.wordpress.com/2012/05/17/linux-kernel-drm-intel-i915-multiple-ioctl-integer-overflows/ It has two issues: 1. overflow of cliprect kmalloc as args->num_cliprects is not bounded and passed in via a user ioctl. Fixed via ed8cd3b2cd61004cab85380c52b1817aca1ca49b in mainline: commit ed8cd3b2cd61004cab85380c52b1817aca1ca49b Author: Xi Wang <xi.wang@...il.com> Date: Mon Apr 23 04:06:41 2012 -0400 drm/i915: fix integer overflow in i915_gem_execbuffer2() On 32-bit systems, a large args->buffer_count from userspace via ioctl may overflow the allocation size, leading to out-of-bounds access. This vulnerability was introduced in commit 8408c282 ("drm/i915: First try a normal large kmalloc for the temporary exec buffers"). 8408c282 was added Feb 21 2011, and seemingly added during 2.6.38 development. 2. same file, overflow in args->buffer_count. Fix is in mainline 44afb3a04391a74309d16180d1e4f8386fdfa745 commit 44afb3a04391a74309d16180d1e4f8386fdfa745 Author: Xi Wang <xi.wang@...il.com> Date: Mon Apr 23 04:06:42 2012 -0400 drm/i915: fix integer overflow in i915_gem_do_execbuffer() On 32-bit systems, a large args->num_cliprects from userspace via ioctl may overflow the allocation size, leading to out-of-bounds access. This vulnerability was introduced in commit 432e58ed ("drm/i915: Avoid allocation for execbuffer object list"). 432e58ed was added during 2.6.37 development. I think it needs 2 CVEs, due to the different kernel versions introducing it. Ciao, Marcus
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.