oss-security - Re: CVE request - kernel: ext4: Make sure the MOVE_EXT ioctl can't overwrite append-only files

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <516728481.319671276087340358.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Wed, 9 Jun 2010 08:42:20 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request - kernel: ext4: Make sure the
 MOVE_EXT ioctl can't overwrite append-only files

----- "Eugene Teo" <eugene@...hat.com> wrote:

> Using the EXT4_IOC_MOVE_EXT ioctl, it is possible to overwrite the 
> contents of an append-only donor file.
> 
> http://git.kernel.org/linus/1f5a81e41f8b1a782c68d3843e9ec1bfaadf7d72
> https://bugzilla.redhat.com/show_bug.cgi?id=601006
> 

Sorry for the delay.

Please use CVE-2010-2066

Thanks

-- 
    JB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.