Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 10 Nov 2010 10:27:46 -0500 (EST)
From: Petr Matousek <>
Subject: CVE request: kernel: L2TP send buffer allocation size overflows

"Both PPPoL2TP (in net/l2tp/l2tp_ppp.c, pppol2tp_sendmsg()) and IPoL2TP (in
net/l2tp/l2tp_ip.c, l2tp_ip_sendmsg()) make calls to sock_wmalloc() that
perform arithmetic on the size argument without any maximum bound. As a result,
by issuing sendto() calls with very large sizes, this allocation size will wrap
and result in a small buffer being allocated, leading to ugliness immediately
after (probably kernel panics due to bad sk_buff tail position, but possibly
kernel heap corruption)."

Credit: Dan Rosenberg


Petr Matousek / Red Hat Security Response Team

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ