[prev in list] [next in list] [prev in thread] [next in thread]
List: oss-security
Subject: Re: [oss-security] CVE request: kernel: Heap corruption in ROSE
From: Eugene Teo <eugene () redhat ! com>
Date: 2010-09-21 4:41:25
Message-ID: 4C983775.8010703 () redhat ! com
[Download RAW message or body]
On 09/21/2010 12:25 PM, Dan Rosenberg wrote:
> When binding a ROSE socket, the "srose_ndigis" field of the
> user-provided sockaddr_rose struct is intended to be restricted to
> less than ROSE_MAX_DIGIS. However, since this field is a signed
> integer, this check will pass when provided with a negative value,
> allowing the "source_ndigis" field of the rose_sock struct (which is
> an unsigned char) to be set to arbitrary values. Then, by calling a
> function such as rose_getname(), heap corruption results, since this
> field is used as a maximum index to read from and write into an array
> of ROSE_MAX_DIGIS size. This can only be triggered by unprivileged
> users when a ROSE device (e.g. rose0) exists.
>
> Reference (and fix):
> http://marc.info/?l=linux-netdev&m=128502238927086&w=2
Please use CVE-2010-3310.
Thanks, Eugene
--
main(i) { putchar(182623909 >> (i-1) * 5&31|!!(i<7)<<6) && main(++i); }
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic