Re: CVE request: kernel: fs/partitions: Kernel heap overflow via corrupted LDM partition tables

[Timo Warns <warns () pre-sense de>]

Am 24.02.2011 02:25, schrieb Eugene Teo:
> On 02/24/2011 03:59 AM, Josh Bressers wrote:
> > ----- Original Message -----
> > > The kernel automatically evaluates partition tables of storage devices.
> > > The code for evaluating LDM partitions (in fs/partitions/ldm.c) contains
> > > a bug that allows to overflow the kernel heap. It may be possible to
> > > escalate privileges by exploiting this bug.
> > >
> > > (This bug is distinct from the LDM bug reported by Eugene Teo on
> > > 2011-02-23.)
> > >
> > > This should affect both, 2.4 and 2.6 kernel. As a prerequisite,
> > > CONFIG_LDM_PARTITION needs to be set.
> >
> > Can you point to a commit message or something else that is public? It's
> > not clear how this differs from Eugene's request.
>
> As far as I can tell, it's not public yet. Timo will follow-up once his
> patch is accepted.

A patch is now available at
http://www.spinics.net/lists/mm-commits/msg83181.html

Best regards, Timo