Messages in this thread | | | Date | Wed, 7 Jul 2010 14:20:52 +0200 (CEST) | From | Stefan Richter <> | Subject | Re: [PATCH v3] firewire: cdev: check write quadlet request length to avoid buffer overflow |
| |
On 7 Jul, Clemens Ladisch wrote: > Stefan Richter wrote: >> [...] Thus the only problem is that a bogus write quadlet >> request with user-specified length of < 3 will put 1...4 random bytes >> into the packet payload. But this is the user's problem then, not the >> kernel's. > > But not being initialized, these are the kernel's bytes that get > disclosed.
Yes. In which way can this be exploited though? For all practical purposes, the signal-to-noise ratio of these 1...4 bytes seems to be 0. -- Stefan Richter -=====-==-=- -=== --=== http://arcgraph.de/sr/
| |