oss-security - CVE request: kernel: fs/partitions: Kernel heap overflow via corrupted LDM partition tables

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4D65016D.6030802@pre-sense.de>
Date: Wed, 23 Feb 2011 13:45:33 +0100
From: Timo Warns <warns@...-sense.de>
To: oss-security@...ts.openwall.com
Subject: CVE request: kernel: fs/partitions: Kernel heap overflow via corrupted
 LDM partition tables

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

The kernel automatically evaluates partition tables of storage devices.
The code for evaluating LDM partitions (in fs/partitions/ldm.c) contains
a bug that allows to overflow the kernel heap. It may be possible to
escalate privileges by exploiting this bug.

(This bug is distinct from the LDM bug reported by Eugene Teo on
2011-02-23.)

This should affect both, 2.4 and 2.6 kernel. As a prerequisite,
CONFIG_LDM_PARTITION needs to be set.

Thanks, Timo

- -- 
Dr. Timo Warns                               warns@...-sense.de
                                  Tel. +49 - 40 - 244 2407 - 16
                                  Fax  +49 - 40 - 244 2407 - 24
PRESENSE Technologies GmbH            Sachsenstr. 5, D-20097 HH
                                         USt-IdNr.: DE263765024
Geschäftsführer/Managing Directors       AG Hamburg, HRB 107844
Till Dörges           Jürgen Sander              Axel Theilmann
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.15 (GNU/Linux)
Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org/

iEYEARECAAYFAk1lAW0ACgkQneTPdraGveU9wwCePDVkbSTEk4Ltzc4mjs/3Ci83
5JIAn26q86H3uucoklA5yps8WwJAmrN4
=ssUq
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.