[lkml]   [2010]   [Jul]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [PATCH v3] firewire: cdev: check write quadlet request length to avoid buffer overflow
    On  7 Jul, Clemens Ladisch wrote:
    > Stefan Richter wrote:
    >> [...] Thus the only problem is that a bogus write quadlet
    >> request with user-specified length of < 3 will put 1...4 random bytes
    >> into the packet payload. But this is the user's problem then, not the
    >> kernel's.
    > But not being initialized, these are the kernel's bytes that get
    > disclosed.

    Yes. In which way can this be exploited though? For all practical
    purposes, the signal-to-noise ratio of these 1...4 bytes seems to be 0.
    Stefan Richter
    -=====-==-=- -=== --===

     \ /
      Last update: 2010-07-07 14:25    [W:0.019 / U:4.608 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site