oss-sec mailing list archives

CVE request: kernel: r128 IOCTL NULL pointer dereferences when CCE state is uninitialised


From: Eugene Teo <eugeneteo () kernel sg>
Date: Mon, 19 Oct 2009 12:58:14 +0800

Quoting from the upstream commit:
"Almost all r128's private ioctls require that the CCE state has already been initialised. However, most do not test that this has been done, and will proceed to dereference a null pointer. This may result in a security vulnerability, since some ioctls are unprivileged.

This adds a macro for the common initialisation test and changes all ioctl implementations that require prior initialisation to use that macro.

Also, r128_do_init_cce() does not test that the CCE state has not been
initialised already. Repeated initialisation may lead to a crash or resource leak. This adds that test."

http://git.kernel.org/linus/7dc482dfeeeefcfd000d4271c4626937406756d7

Other references:
http://secunia.com/advisories/36707/
https://bugzilla.redhat.com/show_bug.cgi?id=529597

Thanks, Eugene


Current thread: