[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] CVE request: kernel: cfg80211: fix looping soft lockup in find_ie()
From:       Eugene Teo <eugeneteo () kernel ! sg>
Date:       2009-09-16 5:32:57
Message-ID: 4AB07889.3070508 () kernel ! sg
[Download RAW message or body]

The find_ie() function uses a size_t for the len parameter, and directly 
uses len as a loop variable.  If any received packets are malformed, it 
is possible for the decrease of len to overflow, and since the result is 
unsigned, the loop will not terminate. Change it to a signed int so the 
loop conditional works for negative values.

find_ie() was introduced in commit 2a519311 (v2.6.30-rc1).

Upstream commit: fcc6cb0c13555e78c2d47257b6d1b5e59b0c419a

Thanks, Eugene
[prev in list] [next in list] [prev in thread] [next in thread]