oss-security - CVE request: kernel: cifs: singedness issue in CIFSFindNext()

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4E546390.9030503@redhat.com>
Date: Wed, 24 Aug 2011 10:36:00 +0800
From: Eugene Teo <eugene@...hat.com>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>
Subject: CVE request: kernel: cifs: singedness issue in CIFSFindNext()

The name_len variable in CIFSFindNext is a signed int that gets set to
the resume_name_len in the cifs_search_info. The resume_name_len however
is unsigned and for some infolevels is populated directly from a 32 bit
value sent by the server.

If the server sends a very large value for this, then that value could
look negative when converted to a signed int. That would make that value
pass the PATH_MAX check later in CIFSFindNext. The name_len would then
be used as a length value for a memcpy. It would then be treated as
unsigned again, and the memcpy scribbles over a ton of memory.

Fix this by making the name_len an unsigned value in CIFSFindNext.

http://www.spinics.net/lists/linux-cifs/msg03950.html
https://bugzilla.redhat.com/show_bug.cgi?id=732869

Thanks, Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.