[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <48FD2932.2070703@redhat.com>
Date: Tue, 21 Oct 2008 08:58:26 +0800
From: Eugene Teo <eteo@...hat.com>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: kernel: sctp: Fix kernel panic while
process protocol violation parameter
Eugene Teo wrote:
> This was committed in upstream kernel recently.
>
> "[PATCH] sctp: Fix kernel panic while process protocol violation parameter
>
> Since call to function sctp_sf_abort_violation() need paramter 'arg'
> with 'struct sctp_chunk' type, it will read the chunk type and chunk
> length from the chunk_hdr member of chunk. But call to
> sctp_sf_violation_paramlen() always with 'struct sctp_paramhdr' type's
> parameter, it will be passed to sctp_sf_abort_violation(). This may
> cause kernel panic."
>
> Upstream commit: ba0166708ef4da7eeb61dd92bbba4d5a749d6561
>
> This is user-triggerable.
Ping Steve. This needs a CVE name too. Thanks!
Eugene
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
