[<prev] [next>] [day] [month] [year] [list]
Message-ID: <alpine.LFD.2.10.1401292034410.25782@wniryva.cad.erqung.pbz>
Date: Wed, 29 Jan 2014 20:51:00 +0530 (IST)
From: P J P <ppandit@...hat.com>
To: oss security list <oss-security@...ts.openwall.com>
Subject: CVE REJECT request: CVE-2013-4588
Hello,
CVE-2013-4588 was assigned to a stack overflow flaw in the Linux kernel.
-> http://seclists.org/fulldisclosure/2013/Nov/77
===
Kernel: net: ipvs: stack buffer overflow
Linux kernel built with the IP Virtual Server(CONFIG_IP_VS) support is
vulnerable to a buffer overflow flaw. It could occur while setting or
retrieving socket options via setsockopt(2) or getsockopt(2) calls.
Though a user needs to have CAP_NET_ADMIN privileges to perform these IP_VS
operations.
Upstream fix:
-------------
-> https://git.kernel.org/linus/04bcef2a83f40c6db24222b27a52892cba39dffb
===
The bounds check added by the above patch are found to be redundant, as the
same is done in routine 'nf_sockopt_find'. [1]
+ if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX)
+ return -EINVAL;
+ if (len < 0 || len > MAX_ARG_LEN)
+ return -EINVAL;
[1] https://lkml.org/lkml/2009/9/30/265
That makes it a security non-issue. Please kindly reject this CVE.
Thank you.
--
Prasad J Pandit / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
