lkml.org 
[lkml]   [2010]   [Jul]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v3] firewire: cdev: check write quadlet request length to avoid buffer overflow
On  7 Jul, Clemens Ladisch wrote:
> Stefan Richter wrote:
>> [...] Thus the only problem is that a bogus write quadlet
>> request with user-specified length of < 3 will put 1...4 random bytes
>> into the packet payload. But this is the user's problem then, not the
>> kernel's.
>
> But not being initialized, these are the kernel's bytes that get
> disclosed.

Yes. In which way can this be exploited though? For all practical
purposes, the signal-to-noise ratio of these 1...4 bytes seems to be 0.
--
Stefan Richter
-=====-==-=- -=== --===
http://arcgraph.de/sr/


\
 
 \ /
  Last update: 2010-07-07 14:25    [from the cache]
©2003-2011 Jasper Spaans