Re: CVE request: FreeBSD/NetBSD 802.11 kernel memory disclosure

[Josh Bressers <bressers () redhat com>]

----- Original Message -----
> On Mon, Jun 20, 2011 at 3:05 PM, Josh Bressers <bressers () redhat com>
> wrote:
> > ----- Original Message -----
> > > NetBSD has committed a fix for an issue in the 802.11 stack [1].
> > > FreeBSD is also affected and should release a fix shortly. Due to a
> > > signedness error in the IEEE80211_IOC_CHANINFO ioctl, a local
> > > unprivileged user could cause the kernel to copy large amounts of
> > > kernel memory back to the user, disclosing potentially sensitive
> > > information. The issue only affects certain non-x86 architectures,
> > > such as SPARC.
> > >
> > > -Dan
> > >
> > > [1]
> > > http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/net80211/ieee80211_ioctl.c?rev=1.56&content-type=text/x-cvsweb-markup&only_with_tag=MAIN
> >
> > I'm not entirely sure how to assign CVE ids for this. Is the code in
> > question shared between FreeBSD and NetBSD, or is it different
> > codebases
> > but the same flaw?
>
> Most of the 802.11 code, including the vulnerable code, is shared
> between FreeBSD and NetBSD.

One ID will work then.

Please use CVE-2011-2480.

Thanks.

-- 
    JB