[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 03 Jan 2011 10:56:35 +0530
From: Huzaifa Sidhpurwala <huzaifas@...hat.com>
To: oss-security@...ts.openwall.com
CC: Eugene Teo <eugene@...hat.com>,
"Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: kernel: irda: prevent integer underflow
in IRLMP_ENUMDEVICES
On 12/23/2010 08:53 AM, Eugene Teo wrote:
> From Dan Rosenbugs :>, "If the user-provided len is less than the
> expected offset, the IRLMP_ENUMDEVICES getsockopt will do a
> copy_to_user() with a very large size value. While this isn't be a
> security issue on x86 because it will get caught by the access_ok()
> check, it may leak large amounts of kernel heap on other architectures.
> In any event, this patch fixes it."
Assigned CVE-2010-4529 to this one.
--
Huzaifa Sidhpurwala / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
