lkml.org 
[lkml]   [2011]   [Jun]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [Stable-review] [087/165] Fix for buffer overflow in ldm_frag_add not sufficient
    On Wed, 2011-06-01 at 17:10 +0900, Greg KH wrote:
    > 2.6.39-stable review patch. If anyone has any objections, please let us know.
    >
    > ------------------
    > Content-Length: 1139
    > Lines: 36
    >
    > From: Timo Warns <Warns@pre-sense.de>
    >
    > commit cae13fe4cc3f24820ffb990c09110626837e85d4 upstream.
    >
    > As Ben Hutchings discovered [1], the patch for CVE-2011-1017 (buffer
    > overflow in ldm_frag_add) is not sufficient. The original patch in
    > commit c340b1d64000 ("fs/partitions/ldm.c: fix oops caused by corrupted
    > partition table") does not consider that, for subsequent fragments,
    > previously allocated memory is used.
    >
    > [1] http://lkml.org/lkml/2011/5/6/407

    I still assert that the function is broken because the fragments are
    copied to incorrect offsets. However, this change should at least make
    it *harmless* junk.

    Ben.

    > Reported-by: Ben Hutchings <ben@decadent.org.uk>
    > Signed-off-by: Timo Warns <warns@pre-sense.de>
    > Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    > Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    >
    > ---
    > fs/partitions/ldm.c | 5 +++++
    > 1 file changed, 5 insertions(+)
    >
    > --- a/fs/partitions/ldm.c
    > +++ b/fs/partitions/ldm.c
    > @@ -1335,6 +1335,11 @@ static bool ldm_frag_add (const u8 *data
    >
    > list_add_tail (&f->list, frags);
    > found:
    > + if (rec >= f->num) {
    > + ldm_error("REC value (%d) exceeds NUM value (%d)", rec, f->num);
    > + return false;
    > + }
    > +
    > if (f->map & (1 << rec)) {
    > ldm_error ("Duplicate VBLK, part %d.", rec);
    > f->map &= 0x7F; /* Mark the group as broken */
    >
    >
    > _______________________________________________
    > Stable-review mailing list
    > Stable-review@linux.kernel.org
    > http://linux.kernel.org/mailman/listinfo/stable-review
    >

    --
    Ben Hutchings
    Once a job is fouled up, anything done to improve it makes it worse.
    [unhandled content-type:application/pgp-signature]
    \
     
     \ /
      Last update: 2011-06-03 04:33    [W:0.024 / U:63.180 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site