[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <AANLkTik1O_p5NSOnfwLAY50k06CWt+xx8GzkuuY0wvR0@mail.gmail.com>
Date: Sun, 20 Mar 2011 15:40:27 -0400
From: Dan Rosenberg <dan.j.rosenberg@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: kernel: multiple issues in ROSE
I sent in a patch [1] resolving two issues in ROSE:
"When parsing the FAC_NATIONAL_DIGIS facilities field, it's possible
for a remote host to provide more digipeaters than expected, resulting
in heap corruption. Check against ROSE_MAX_DIGIS to prevent
overflows, and abort facilities parsing on failure.
Additionally, when parsing the FAC_CCITT_DEST_NSAP and
FAC_CCITT_SRC_NSAP facilities fields, a remote host can provide a
length of less than 10, resulting in an underflow in a memcpy size,
causing a kernel panic due to massive heap corruption. A length of
greater than 20 results in a stack overflow of the callsign array.
Abort facilities parsing on these invalid length values."
These issues may both result in code execution. They may be triggered
by a remote attacker if the victim has a listening ROSE socket, or by
a local attacker (for privilege escalation) if a ROSE device exists
(e.g. rose0).
Ben Hutchings followed up with a patch [2] that resolves a number of
other ROSE issues related to lack of size field validation, some of
which may also result in heap corruption.
Not sure about the proper CVE breakdown for all these issues, since
the entire protocol was quite broken. Perhaps one is enough to cover
everything.
Regards,
Dan
[1] http://marc.info/?l=linux-netdev&m=130060344616926
[2] http://marc.info/?l=linux-netdev&m=130063972406389&w=2
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
