Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 21 Apr 2009 21:29:23 +0800
From: Eugene Teo <>
Subject: Re: CVE request? buffer overflow in CIFS in 2.6.*

Marcus Meissner wrote:
> On Tue, Apr 21, 2009 at 10:59:25AM +0800, Eugene Teo wrote:
>> Marcus Meissner wrote:
>>> On Tue, Apr 07, 2009 at 01:41:44PM +0800, Eugene Teo wrote:
>>>> Hi Marcus,
>>>> Marcus Meissner wrote:
>>>>> Fixes a kmalloc area overflow in CIFS, number of overwritten bytes
>>>>> is depending on the codepage converted to.
>>>>> The data seems to come from a remote generated reply blob even, correct
>>>>> me if I am wrong. :/
>>>> Looks like it's part of the session setup. The NativeFileSystem field is
>>>> part of the Tree Connect response (TCon for short).
>>>>> And I wonder if "len*2" is sufficient, can't a UCS -> UTF8 conversion
>>>>> generate more than 2 byte utf-8 characters for 1 ucs character?
>>>> I understand that someone from your side is working on a better patch
>>>> for this. Do keep us updated when it goes upstream.
>>> tracked in the public bugzilla entry:
>>> and:
>>> ff.
>>> for the cifs discussion.
>> Here's an update:
> Our maintainer also referenced:
> They are already in the CIFS git tree:

As discussed with Marcus, these two are unrelated to this issue, so we
will need new CVE names.

I spoke to Jeff Layton about this, and it looks like there are some more
in the pipeline (but unrelated to this issue), so stay tuned.

Thanks, Eugene
Eugene Teo / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.