lkml.org 
[lkml]   [2001]   [Jul]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [CHECKER] 52 probable security holes in 2.4.6 and 2.4.6-ac2
Date
From
> [BUG] Need a lower-bound check-- lo_encrypt_key_size is an int
> /home/kash/linux/2.4.6/drivers/block/loop.c:782:loop_set_status: ERROR:RANGE:757:782: Using user length "lo_encrypt_key_size" as argument to "memcpy" [type=LOCAL] [state = need_lb] set by 'copy_from_user':759 [linkages -> 759:info->lo_encrypt_key_size -> 757:info:start] [distance=110]
> if (lo->lo_encrypt_key_size && lo->lo_key_owner != current->uid &&

This one looks like a tool error

if ((unsigned int) info.lo_encrypt_key_size > LO_KEY_SIZE)

so the check is cast

In looking at the located ones I also found it missed a pile of related problems
it can check

There were a pile of

item *p=kmalloc(sizeof(item)*num_items);
if(p==NULL)
error

for(i=0;i<num_items;i++)
{
..
}

Where people rely on the kmalloc failing but forget that

large value * sizeof(item) -> small value after overflow
and the loop stomps all over kernel memory..


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 12:57    [W:0.056 / U:0.164 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site