[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <BANLkTik1ZsRT69dyrFCLkOYRGKC=r7uSzA@mail.gmail.com>
Date: Fri, 24 Jun 2011 19:15:05 -0400
From: Dan Rosenberg <dan.j.rosenberg@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: kernel: remote buffer overflow in bluetooth
A remote user can provide a small value for the command size field in
the command header of an l2cap configuration request, resulting in an
integer underflow when subtracting the size of the configuration request
header. This results in copying a very large amount of data via
memcpy() and destroying the kernel heap. [1]
-Dan
[1] http://marc.info/?l=linux-kernel&m=130891911909436&w=2
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
