CVE request: kernel: Heap corruption in ROSE

[Dan Rosenberg <dan.j.rosenberg () gmail com>]

When binding a ROSE socket, the "srose_ndigis" field of the
user-provided sockaddr_rose struct is intended to be restricted to
less than ROSE_MAX_DIGIS.  However, since this field is a signed
integer, this check will pass when provided with a negative value,
allowing the "source_ndigis" field of the rose_sock struct (which is
an unsigned char) to be set to arbitrary values.  Then, by calling a
function such as rose_getname(), heap corruption results, since this
field is used as a maximum index to read from and write into an array
of ROSE_MAX_DIGIS size.  This can only be triggered by unprivileged
users when a ROSE device (e.g. rose0) exists.

Reference (and fix):
http://marc.info/?l=linux-netdev&m=128502238927086&w=2

-Dan