oss-sec mailing list archives
Re: CVE request: kernel: Heap corruption in ROSE
From: Eugene Teo <eugene () redhat com>
Date: Tue, 21 Sep 2010 12:41:25 +0800
On 09/21/2010 12:25 PM, Dan Rosenberg wrote:
When binding a ROSE socket, the "srose_ndigis" field of the user-provided sockaddr_rose struct is intended to be restricted to less than ROSE_MAX_DIGIS. However, since this field is a signed integer, this check will pass when provided with a negative value, allowing the "source_ndigis" field of the rose_sock struct (which is an unsigned char) to be set to arbitrary values. Then, by calling a function such as rose_getname(), heap corruption results, since this field is used as a maximum index to read from and write into an array of ROSE_MAX_DIGIS size. This can only be triggered by unprivileged users when a ROSE device (e.g. rose0) exists. Reference (and fix): http://marc.info/?l=linux-netdev&m=128502238927086&w=2
Please use CVE-2010-3310. Thanks, Eugene -- main(i) { putchar(182623909 >> (i-1) * 5&31|!!(i<7)<<6) && main(++i); }
Current thread:
- CVE request: kernel: Heap corruption in ROSE Dan Rosenberg (Sep 20)
- Re: CVE request: kernel: Heap corruption in ROSE Eugene Teo (Sep 20)