lkml.org 
[lkml]   [2011]   [Jun]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [Stable-review] [087/165] Fix for buffer overflow in ldm_frag_add not sufficient
On Wed, 2011-06-01 at 17:10 +0900, Greg KH wrote:
> 2.6.39-stable review patch. If anyone has any objections, please let us know.
>
> ------------------
> Content-Length: 1139
> Lines: 36
>
> From: Timo Warns <Warns@pre-sense.de>
>
> commit cae13fe4cc3f24820ffb990c09110626837e85d4 upstream.
>
> As Ben Hutchings discovered [1], the patch for CVE-2011-1017 (buffer
> overflow in ldm_frag_add) is not sufficient. The original patch in
> commit c340b1d64000 ("fs/partitions/ldm.c: fix oops caused by corrupted
> partition table") does not consider that, for subsequent fragments,
> previously allocated memory is used.
>
> [1] http://lkml.org/lkml/2011/5/6/407

I still assert that the function is broken because the fragments are
copied to incorrect offsets. However, this change should at least make
it *harmless* junk.

Ben.

> Reported-by: Ben Hutchings <ben@decadent.org.uk>
> Signed-off-by: Timo Warns <warns@pre-sense.de>
> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
>
> ---
> fs/partitions/ldm.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> --- a/fs/partitions/ldm.c
> +++ b/fs/partitions/ldm.c
> @@ -1335,6 +1335,11 @@ static bool ldm_frag_add (const u8 *data
>
> list_add_tail (&f->list, frags);
> found:
> + if (rec >= f->num) {
> + ldm_error("REC value (%d) exceeds NUM value (%d)", rec, f->num);
> + return false;
> + }
> +
> if (f->map & (1 << rec)) {
> ldm_error ("Duplicate VBLK, part %d.", rec);
> f->map &= 0x7F; /* Mark the group as broken */
>
>
> _______________________________________________
> Stable-review mailing list
> Stable-review@linux.kernel.org
> http://linux.kernel.org/mailman/listinfo/stable-review
>

--
Ben Hutchings
Once a job is fouled up, anything done to improve it makes it worse.
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2011-06-03 04:33    [from the cache]
©2003-2011 Jasper Spaans