Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 15 Apr 2014 23:59:36 +0530 (IST)
From: P J P <>
To: oss security list <>
Subject: CVE request Linux kernel: arch: x86: net: bpf_jit: an off-by-one
 bug in x86_64 cond jump target


An off-by-one bug is found in the x86_64 cond jump target of the BPF JIT 
filter code. In case a conditional jump is followed by a long jump, 
conditional jump target is one byte past the start of target instruction.

A user/program could use this flaw to crash the kernel resulting in DoS, or 
potentially escalate user privileges on a system to gain root access.

Upstream fix:

Introduced by:

Note: BPF JIT is disabled by default, must be enabled by the admin.

Thank you.
Prasad J Pandit / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.