[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1281749317.7543.547.camel@localhost>
Date: Sat, 14 Aug 2010 02:28:37 +0100
From: Ben Hutchings <ben@...adent.org.uk>
To: Eugene Teo <eugene@...hat.com>
Cc: oss-security@...ts.openwall.com, dann frazier <dannf@...ian.org>,
"Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: kernel: [PARISC] led.c - fix potential stack
overflow in led_proc_write()
On Sat, 2010-08-14 at 09:00 +0800, Eugene Teo wrote:
> On 08/14/2010 08:54 AM, dann frazier wrote:
> > On Tue, Aug 03, 2010 at 01:51:15AM -0400, Moritz Muehlenhoff wrote:
> >> On Tue, Aug 03, 2010 at 11:46:58AM +0800, Eugene Teo wrote:
> >>> Ilja reported way back in Nov 2007. A writer to /proc/pdc/led(?) can
> >>> cause the kernel to consume an unbounded amount of stack, and result
> >>> in stack corruption.
> >>>
> >>> http://www.spinics.net/lists/linux-parisc/msg02960.html
> >>>
> >>> If you need a CVE name, change the subject to indicate that. We are
> >>> not requesting one as we do not support the PA-RISC architecture in
> >>> our distribution.
> >>
> >> Debian supports hppa.
> >>
> >> Steven, please assign a CVE ID.
> >
> > Ben Hutchings pointed out that this file is only writeable by root -
> > can it therefore be considered a security issue?
>
> From the bug report:
> "the problem being that the stack is limited and count is not (except
> for the MAX_INT check done in sys_write() I guess). this could lead to
> stack corruption (when for example calling capable())."
But the file permissions are checked even before the function is called,
are they not?
Ben.
--
Ben Hutchings
Once a job is fouled up, anything done to improve it makes it worse.
Download attachment "signature.asc" of type "application/pgp-signature" (829 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
