Re: CVE request - kernel: drm: integer overflow in drm_mode_dirtyfb_ioctl()

[Kurt Seifried <kseifried () redhat com>]

On 01/11/2012 03:50 AM, Eugene Teo wrote:
> There is a potential integer overflow in drm_mode_dirtyfb_ioctl() if
> userspace passes in a large num_clips.  The call to kmalloc would
> allocate a small buffer, and the call to fb->funcs->dirty may result in
> a memory corruption.
>
> Reported-by: Haogang Chen <haogangchen () gmail com>
> Signed-off-by: Xi Wang <xi.wang () gmail com>
>
> Upstream commit:
> http://git.kernel.org/linus/a5cd335165e31db9dbab636fd29895d41da55dd2
Please use CVE-2012-0044 for this issue.

-- 

-- Kurt Seifried / Red Hat Security Response Team