Subject: APPLIED: [CVE-2011-1759] semtimedop nops overflow
- msg#00032

Previous Message by Date:

APPLIED: [CVE-2011-1476] generic MIDI sequencer underflow

On 02/02/2012 03:14 AM, Andy Whitcroft wrote: CVE-2011-1476 Specially crafted requests may be written to /dev/sequencer resulting in an underflow when calculating a size for a copy_from_user() operation in the driver for MIDI interfaces. On x86, this just returns an error, but it may cause memory corruption on other architectures. Other malformed requests may result in the use of uninitialized variables. The fix for this has hit lucid and later via mainline and stable. Following this email is a patch for hardy and maverick/ti-omap4, this is a simple cherry-pick from the mainline fix. It should be noted that we do not have OSS enabled in later releases but people do use our source to make their own kernels so I am proposing we apply it to the one missed release. It is arguable we should not bother applying this maverick/ti-omap4. Proposing for hardy and maverick/ti-omap4. -apw -- Tim Gardner tim.gardner@xxxxxxxxxxxxx -- kernel-team mailing list kernel-team@xxxxxxxxxxxxxxxx https://lists.ubuntu.com/mailman/listinfo/kernel-team

Next Message by Date:

APPLIED: [CVE-2011-1476] generic MIDI sequencer underflow

Previous Message by Thread:

Ack: Re: [maverick/ti-omap4, natty/ti-omap4 CVE 1/1] ARM: 6891/1: prevent heap corruption in OABI semtimedop

On Thu, Feb 02, 2012 at 10:59:59AM +0000, Andy Whitcroft wrote: > From: Dan Rosenberg <drosenberg@xxxxxxxxxxxxx> > > When CONFIG_OABI_COMPAT is set, the wrapper for semtimedop does not > bound the nsops argument. A sufficiently large value will cause an > integer overflow in allocation size, followed by copying too much data > into the allocated buffer. Fix this by restricting nsops to SEMOPM. > Untested. > > Cc: stable@xxxxxxxxxx > Signed-off-by: Dan Rosenberg <drosenberg@xxxxxxxxxxxxx> > Signed-off-by: Russell King <rmk+kernel@xxxxxxxxxxxxxxxx> > > (cherry picked from commit 0f22072ab50cac7983f9660d33974b45184da4f9) > CVE-2011-1759 > BugLink: http://bugs.launchpad.net/bugs/925373 > Signed-off-by: Andy Whitcroft <apw@xxxxxxxxxxxxx> > --- > arch/arm/kernel/sys_oabi-compat.c | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) > > diff --git a/arch/arm/kernel/sys_oabi-compat.c > b/arch/arm/kernel/sys_oabi-compat.c > index d59a0cd..897b879 100644 > --- a/arch/arm/kernel/sys_oabi-compat.c > +++ b/arch/arm/kernel/sys_oabi-compat.c > @@ -311,7 +311,7 @@ asmlinkage long sys_oabi_semtimedop(int semid, > long err; > int i; > > - if (nsops < 1) > + if (nsops < 1 || nsops > SEMOPM) > return -EINVAL; > sops = kmalloc(sizeof(*sops) * nsops, GFP_KERNEL); > if (!sops) > -- > 1.7.8.3 > > > -- > kernel-team mailing list > kernel-team@xxxxxxxxxxxxxxxx > https://lists.ubuntu.com/mailman/listinfo/kernel-team > -- kernel-team mailing list kernel-team@xxxxxxxxxxxxxxxx https://lists.ubuntu.com/mailman/listinfo/kernel-team