[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20090421082503.GB21923@suse.de>
Date: Tue, 21 Apr 2009 10:25:03 +0200
From: Marcus Meissner <meissner@...e.de>
To: Eugene Teo <eugene@...hat.com>
Cc: oss-security@...ts.openwall.com, security@...nel.org,
sfrench@...ibm.com
Subject: Re: CVE request? buffer overflow in CIFS in 2.6.*
On Tue, Apr 21, 2009 at 10:59:25AM +0800, Eugene Teo wrote:
> Marcus Meissner wrote:
> > On Tue, Apr 07, 2009 at 01:41:44PM +0800, Eugene Teo wrote:
> >> Hi Marcus,
> >>
> >> Marcus Meissner wrote:
> >>> Fixes a kmalloc area overflow in CIFS, number of overwritten bytes
> >>> is depending on the codepage converted to.
> >>>
> >>> The data seems to come from a remote generated reply blob even, correct
> >>> me if I am wrong. :/
> >> Looks like it's part of the session setup. The NativeFileSystem field is
> >> part of the Tree Connect response (TCon for short).
> >>
> >>> And I wonder if "len*2" is sufficient, can't a UCS -> UTF8 conversion
> >>> generate more than 2 byte utf-8 characters for 1 ucs character?
> >> I understand that someone from your side is working on a better patch
> >> for this. Do keep us updated when it goes upstream.
> >
> > tracked in the public bugzilla entry:
> > https://bugzilla.novell.com/show_bug.cgi?id=492282
> >
> > and:
> > http://lists.samba.org/archive/linux-cifs-client/2009-April/004322.html ff.
> > for the cifs discussion.
>
> Here's an update:
> http://lkml.org/lkml/2009/4/20/21
Our maintainer also referenced:
http://lists.samba.org/archive/linux-cifs-client/2009-April/004450.html
http://lists.samba.org/archive/linux-cifs-client/2009-April/004452.html
They are already in the CIFS git tree:
http://git.kernel.org/?p=linux/kernel/git/sfrench/cifs-2.6.git;a=summary
http://git.kernel.org/?p=linux/kernel/git/sfrench/cifs-2.6.git;a=commit;h=7b0c8fcff47a885743125dd843db64af41af5a61
http://git.kernel.org/?p=linux/kernel/git/sfrench/cifs-2.6.git;a=commit;h=968460ebd8006d55661dec0fb86712b40d71c413
Ciao, Marcus
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
