Messages in this thread | | | Date | Tue, 28 Jun 2011 14:59:37 -0300 | From | "Gustavo F. Padovan" <> | Subject | Re: [PATCH] Bluetooth: Prevent buffer overflow in l2cap config request |
| |
Hi Dan,
* Dan Rosenberg <drosenberg@vsecurity.com> [2011-06-24 08:38:05 -0400]:
> A remote user can provide a small value for the command size field in > the command header of an l2cap configuration request, resulting in an > integer underflow when subtracting the size of the configuration request > header. This results in copying a very large amount of data via > memcpy() and destroying the kernel heap. Check for underflow. > > Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> > Cc: stable <stable@kernel.org> > --- > net/bluetooth/l2cap_core.c | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-)
Applied, thanks.
Gustavo
| |