[prev in list] [next in list] [prev in thread] [next in thread]
List: oss-security
Subject: Re: [oss-security] CVE request - kernel: pktcdvd ioctl dev_minor
From: Josh Bressers <bressers () redhat ! com>
Date: 2010-09-28 19:42:35
Message-ID: 1862982385.592341285702955007.JavaMail.root () zmail01 ! collab ! prod ! int ! phx2 ! redhat ! com
[Download RAW message or body]
Please use CVE-2010-3437
Thanks.
--
JB
----- "Eugene Teo" <eugeneteo@kernel.sg> wrote:
> As Dan Rosenberg explained in the patch commit: The
> PKT_CTRL_CMD_STATUS
> device ioctl retrieves a pointer to a pktcdvd_device from the global
> pkt_devs array. The index into this array is provided directly by the
>
> user and is a signed integer, so the comparison to ensure that it
> falls
> within the bounds of this array will fail when provided with a
> negative
> index.
>
> This can be used to read arbitrary kernel memory or cause a crash due
> to
> an invalid pointer dereference. This can be exploited by users with
> permission to open /dev/pktcdvd/control (on many distributions, this
> is
> readable by group "cdrom").
>
> https://bugzilla.redhat.com/show_bug.cgi?id=638085
> http://git.kernel.org/linus/252a52aa4fa22a668f019e55b3aac3ff71ec1c29
>
> This was introduced in 2f8e2dc8 (v2.6.10-rc1).
>
> Thanks, Eugene
> --
> main(i) { putchar(182623909 >> (i-1) * 5&31|!!(i<7)<<6) && main(++i);
> }
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic