oss-security - Re: CVE request: kernel: gdth: integer overflow in ioc

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <692863064.573491289417485995.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Wed, 10 Nov 2010 14:31:25 -0500 (EST)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com, Petr Matousek <pmatouse@...hat.com>
Cc: coley@...us.mitre.org
Subject: Re: CVE request: kernel: gdth: integer overflow in
 ioc_general()

Please use CVE-2010-4157

Thanks.

-- 
    JB


----- "Petr Matousek" <pmatouse@...hat.com> wrote:

> "gdth_ioctl_alloc() takes the size variable as an int.
> copy_from_user() takes the size variable as an unsigned long.
> gen.data_len and gen.sense_len are unsigned longs.
> On x86_64 longs are 64 bit and ints are 32 bit.
> 
> We could pass in a very large number and the allocation would
> truncate
> the size to 32 bits and allocate a small buffer.  Then when we do the
> copy_from_user(), it would result in a memory corruption."
> 
> Upstream commit:
> http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=f63ae56e4e97fb12053590e41a4fa59e7daa74a4
> 
> Credit: James E.J. Bottomley
> 
> Reference:
> http://ns3.spinics.net/lists/linux-scsi/msg47361.html
> https://bugzilla.redhat.com/show_bug.cgi?id=651147
> 
> Thanks,
> --
> Petr Matousek / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.