Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: CVE request - kernel: drm: integer overflow in drm_mode_dirtyfb_ioctl()
From: Kurt Seifried <kseifried () redhat com>
Date: Wed, 11 Jan 2012 17:09:02 -0700

On 01/11/2012 03:50 AM, Eugene Teo wrote:
There is a potential integer overflow in drm_mode_dirtyfb_ioctl() if
userspace passes in a large num_clips.  The call to kmalloc would
allocate a small buffer, and the call to fb->funcs->dirty may result in
a memory corruption.

Reported-by: Haogang Chen <haogangchen () gmail com>
Signed-off-by: Xi Wang <xi.wang () gmail com>

Upstream commit:
http://git.kernel.org/linus/a5cd335165e31db9dbab636fd29895d41da55dd2
Please use CVE-2012-0044 for this issue.

-- 

-- Kurt Seifried / Red Hat Security Response Team


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]