[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <4F0CB174.1000002@redhat.com>
Date: Tue, 10 Jan 2012 14:45:24 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Xi Wang <xi.wang@...il.com>
Subject: Re: CVE request: kernel: xfs heap overflow
On 01/10/2012 02:19 PM, Kurt Seifried wrote:
> On 01/10/2012 11:57 AM, Xi Wang wrote:
>> Commit ef14f0c1578dce4b688726eb2603e50b62d6665a introduced an integer
>> overflow in the ACL handling code, which could further lead to
>> heap-based buffer overflow via a crafted filesystem.
>>
>> Upstream commits:
>> http://git.kernel.org/linus/fa8b18edd752a8b4e9d1ee2cd615b82c93cf8bba
>> http://git.kernel.org/linus/093019cf1b18dd31b2c3b77acce4e000e2cbc9ce
>>
>> Both commits are needed to fix the vulnerability.
>>
>> The vulnerability seems to first appear in 2.6.32-rc1. 3.2 contains
>> only the first commit.
>>
>> - xi
> Do you need a CVE for this?
>
I apologize, I'm still getting used to Thunderbird (Vince says I should
use mutt, I suspect he may be correct) which places the subject line
well above the message body so when I scan it I'm usually looking at the
To: and CC: line and not seeing the subject (as evidenced by me asking
stupid questions like this about once a day =).
Please use CVE-2012-0038 for this kernel issue.
--
-- Kurt Seifried / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
