Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 17 Sep 2015 14:51:26 -0400
From: Steve Dickson <SteveD@...hat.com>
To: cve-assign@...re.org, meissner@...e.de
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE Request: remote triggerable use-after-free in rpcbind



On 09/17/2015 12:20 PM, cve-assign@...re.org wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
> 
>> http://www.spinics.net/lists/linux-nfs/msg53045.html
>> https://bugzilla.suse.com/show_bug.cgi?id=946204
> 
>> frees the netbuf caller_addr and caller_addr.buf. However, it does not
>> clear xp_rtaddr, so xp_rtaddr.buf now refers to memory region A, which
>> is free.
>>
>> ... It will reuse the buffer inside xp_rtaddr
> 
> Use CVE-2015-7236.
Will there be a bz opened up? 

steved.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.