|Main Archive Page > Month Archives > oss-security archives|
"struct sco_conninfo has one padding byte in the end. Local variable
cinfo of type sco_conninfo is copied to userspace with this
uninizialized one byte, leading to old stack contents leak."
"Struct ca is copied from userspace. It is not checked whether the
"device" field is NULL terminated. This potentially leads to BUG()
inside of alloc_netdev_mqs() and/or information leak by creating a
device with a name made of contents of kernel stack."
"Struct tmp is copied from userspace. It is not checked whether the
"name" field is NULL terminated. This may lead to buffer overflow and
passing contents of kernel stack as a module name to
try_then_request_module() and, consequently, to modprobe commandline.
It would be seen by all userspace processes."
The vulnerable code was written before the "git epoch". One needs
CAP_NET_ADMIN to exploit the 2nd and the 3rd.
JFI, the patch to prevent the panic inside of alloc_netdev() (to prevent
analogues of #2) was rejected by upstream:
-- Vasiliy Kulikov http://www.openwall.com - bringing security into open computing environments