Date: Tue, 15 Apr 2014 23:59:36 +0530 (IST) From: P J P <ppandit@...hat.com> To: oss security list <oss-security@...ts.openwall.com> Subject: CVE request Linux kernel: arch: x86: net: bpf_jit: an off-by-one bug in x86_64 cond jump target Hello, An off-by-one bug is found in the x86_64 cond jump target of the BPF JIT filter code. In case a conditional jump is followed by a long jump, conditional jump target is one byte past the start of target instruction. A user/program could use this flaw to crash the kernel resulting in DoS, or potentially escalate user privileges on a system to gain root access. Upstream fix: ------------- -> https://git.kernel.org/linus/a03ffcf873fe0f2565386ca8ef832144c42e67fa Introduced by: -------------- -> https://git.kernel.org/linus/0a14842f5a3c0e88a1e59fac5c3025db39721f74 Note: BPF JIT is disabled by default, must be enabled by the admin. Thank you. -- Prasad J Pandit / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.