[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <4FA78B7E.6070806@pre-sense.de>
Date: Mon, 07 May 2012 10:44:46 +0200
From: Timo Warns <warns@...-sense.de>
To: oss-security@...ts.openwall.com
Subject: CVE request: Linux kernel: Buffer overflow in HFS plus filesystem
The Linux kernel (at least 3.x <= 3.3.4 and 2.6.x <= 2.6.35.13) contains
a vulnerability in the driver for HFS plus file systems that may be
exploited for code execution or privilege escalation.
A specially-crafted HFS plus filesystem can cause a buffer overflow via
the memcpy() call of hfs_bnode_read() (in fs/hfsplus/bnode.c). The functions
hfsplus_rename_cat() (in fs/hfsplus/catalog.c) and
hfsplus_readdir() (in fs/hfsplus/dir.c)
call hfs_bnode_read() with values that result in a memcpy() call with a
fixed-length destination buffer and both, a source buffer and length,
that are read from the filesystem without sufficient validation.
The buffer overflows were previously fixed in the HFS filesystem driver
and have been assigned CVE-2009-4020 (commit
ec81aecb29668ad71f699f4e7b96ec46691895b6 [1]).
Commit 6f24f892871acc47b40dd594c63606a17c714f77 ("hfsplus: fix a
potential buffer overflow") [2] also fixes the issue in the HFS plus
filesystem driver.
[1] http://git.kernel.org/linus/ec81aecb29668ad71f699f4e7b96ec46691895b6
[2] http://git.kernel.org/linus/6f24f892871acc47b40dd594c63606a17c714f77
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
