Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 6 Jan 2011 09:18:11 -0700
From: dann frazier <>
To: Ben Hutchings <>,
	"Steven M. Christey" <>
Cc: Debian kernel maintainers <>,,
Subject: CVE Request: kernel [Re: Security review of]

On Thu, Jan 06, 2011 at 01:05:47AM +0000, Ben Hutchings wrote:
> These are the patches that looked security-relevant, from a fairly quick
> review:

Thanks for the review Ben! Steve, can you assign CVEs for the
following issues?

> [03/49] fuse: verify ioctl retries
> Kernel buffer overflow, but only CUSE servers could exploit it and
> /dev/cuse is normally restricted to root.

Upstream fix:
Introduced in 2.6.29.

> [16/49] IB/uverbs: Handle large number of entries in poll CQ
> Fixes integer overflow and information leak which I assume can be triggered
> by unprivileged local users.

Sounds like it - Documentation/infiniband/user_verbs.txt says:

 "Since the InfiniBand userspace verbs should be safe for use by
 non-privileged processes, it may be useful to add an appropriate MODE
 or GROUP to the udev rule."

Upstream fix:
Introduced in 2.6.15.

> [20/49] orinoco: fix TKIP countermeasure behaviour
> Fixes cryptographic weakness potentially leaking information to remote
> (but physically nearby) users.

Upstream fix:
Introduced in 2.6.28.

> [24/49] tracing: Fix panic when lseek() called on "trace" opened for writing
> File is normally only writable by root, so not a security issue.


> [33/49] [SCSI] bfa: fix system crash when reading sysfs fc_host statistics
> Local denial-of-service.
> CVE-2010-4343
> [36/49] install_special_mapping skips security_file_mmap check.
> May enable privilege escalation through null pointer bugs that would
> otherwise only cause denial-of-service.
> CVE-2010-4346
> [42/49] sound: Prevent buffer overflow in OSS load_mixer_volumes
> Not relevant to Debian kernel images since we don't build OSS.
> CVE-2010-4257
> [44/49] ima: fix add LSM rule bug
> Allows subversion of IMA.  Not relevant to Debian kernel images since we
> don't build IMA.

Upstream fix:
Introoduced in 2.6.30.

> [48/49] sctp: Fix a race between ICMP protocol unreachable and connect()
> Remote denial-of-service.
> CVE-2010-4526
> Ben.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.