[prev in list] [next in list] [prev in thread] [next in thread]
List: oss-security
Subject: Re: [oss-security] CVE request - kernel: jfs: don't allow os2 xattr
From: Josh Bressers <bressers () redhat ! com>
Date: 2010-08-20 17:32:22
Message-ID: 1588732992.1101451282325542424.JavaMail.root () zmail01 ! collab ! prod ! int ! phx2 ! redhat ! com
[Download RAW message or body]
Please use CVE-2010-2946
Thanks.
--
JB
----- "Eugene Teo" <eugeneteo@kernel.sg> wrote:
> Upstream commit: aca0fa34bdaba39bfddddba8ca70dba4782e8fe6
>
> Description from the commit: It's currently possible to bypass xattr
> namespace access rules by prefixing valid xattr names with "os2.",
> since
> the os2 namespace stores extended attributes in a legacy format with
> no
> prefix.
>
> This patch adds checking to deny access to any valid namespace prefix
>
> following "os2.".
>
> Thanks, Eugene
> --
> main(i) { putchar(182623909 >> (i-1) * 5&31|!!(i<7)<<6) && main(++i);
> }
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic