Home page logo

oss-sec logo oss-sec mailing list archives

Re: CVE request: kernel: xfs heap overflow
From: Kurt Seifried <kseifried () redhat com>
Date: Tue, 10 Jan 2012 14:45:24 -0700

On 01/10/2012 02:19 PM, Kurt Seifried wrote:
On 01/10/2012 11:57 AM, Xi Wang wrote:
Commit ef14f0c1578dce4b688726eb2603e50b62d6665a introduced an integer
overflow in the ACL handling code, which could further lead to
heap-based buffer overflow via a crafted filesystem.

Upstream commits:

Both commits are needed to fix the vulnerability.

The vulnerability seems to first appear in 2.6.32-rc1.  3.2 contains
only the first commit.

- xi
Do you need a CVE for this?

I apologize, I'm still getting used to Thunderbird (Vince says I should
use mutt, I suspect he may be correct) which places the subject line
well above the message body so when I scan it I'm usually looking at the
To: and CC: line and not seeing the subject (as evidenced by me asking
stupid questions like this about once a day =).

Please use CVE-2012-0038 for this kernel issue.


-- Kurt Seifried / Red Hat Security Response Team

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]