oss-security - CVE request - gfs2 kernel issue

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4BD64DD3.7070804@redhat.com>
Date: Tue, 27 Apr 2010 10:37:07 +0800
From: Eugene Teo <eugene@...hat.com>
To: oss-security@...ts.openwall.com
CC: coley@...us.mitre.org
Subject: CVE request - gfs2 kernel issue

When a struct gfs2_quota straddles a page boundary, the two pages 
required to write out the complete quota were not being updated. 
Instead, the first page was being written beyond its end. This buffer 
overflow can cause a kernel panic. Since only the value field in struct 
gfs2_quota needs to be updated and it's a 64-bit quantity that doesn't 
ever straddle a page boundary by itself, we can seek to the proper page 
where this value lies and write to it.

Steps to reproduce:
https://bugzilla.redhat.com/show_bug.cgi?id=586006

My colleague will be posting the patch for the upstream kernel soon.

Thanks, eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.