oss-sec mailing list archives
CVE request: kernel: irda: prevent integer underflow in IRLMP_ENUMDEVICES
From: Eugene Teo <eugene () redhat com>
Date: Thu, 23 Dec 2010 11:23:00 +0800
From Dan Rosenbugs :>, "If the user-provided len is less than the expected offset, the IRLMP_ENUMDEVICES getsockopt will do a copy_to_user() with a very large size value. While this isn't be a security issue on x86 because it will get caught by the access_ok() check, it may leak large amounts of kernel heap on other architectures. In any event, this patch fixes it."
http://www.spinics.net/lists/netdev/msg150842.html Thanks, Eugene2
Current thread:
- CVE request: kernel: irda: prevent integer underflow in IRLMP_ENUMDEVICES Eugene Teo (Dec 22)
