[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.LFD.2.10.1404152345080.4513@wniryva.cad.erqung.pbz>
Date: Tue, 15 Apr 2014 23:59:36 +0530 (IST)
From: P J P <ppandit@...hat.com>
To: oss security list <oss-security@...ts.openwall.com>
Subject: CVE request Linux kernel: arch: x86: net: bpf_jit: an off-by-one
bug in x86_64 cond jump target
Hello,
An off-by-one bug is found in the x86_64 cond jump target of the BPF JIT
filter code. In case a conditional jump is followed by a long jump,
conditional jump target is one byte past the start of target instruction.
A user/program could use this flaw to crash the kernel resulting in DoS, or
potentially escalate user privileges on a system to gain root access.
Upstream fix:
-------------
-> https://git.kernel.org/linus/a03ffcf873fe0f2565386ca8ef832144c42e67fa
Introduced by:
--------------
-> https://git.kernel.org/linus/0a14842f5a3c0e88a1e59fac5c3025db39721f74
Note: BPF JIT is disabled by default, must be enabled by the admin.
Thank you.
--
Prasad J Pandit / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
