[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] Re: CVE request: kernel: mm: avoid wrapping vm_pgoff in mremap()
From:       Eugene Teo <eteo () redhat ! com>
Date:       2011-06-27 3:22:10
Message-ID: 4E07F762.2050000 () redhat ! com
[Download RAW message or body]

On 06/25/2011 04:19 AM, Petr Matousek wrote:
> Description of the problem:
> The normal mmap paths all avoid creating a mapping where the pgoff
> inside the mapping could wrap around due to overflow.  However, an
> expanding mremap() can take such a non-wrapping mapping and make it
> bigger and cause a wrapping condition. There is also another case
> where we expand mappings hiding in plain sight: the automatic stack
> expansion.
> 
> The wrapping condition can cause a BUG_ON() due to terminally
> confusing the vma_prio_tree code.

Please use CVE-2011-2496.

Eugene
[prev in list] [next in list] [prev in thread] [next in thread]