Messages in this thread | | | From | "Elias, Ilan" <> | Subject | RE: [PATCH] NFC: prevent multiple buffer overflows in NCI | Date | Sun, 24 Jun 2012 07:50:05 +0000 |
| |
Hi Dan,
> From: Dan Rosenberg [mailto:dan.j.rosenberg@gmail.com] > Sent: Thursday, June 21, 2012 10:56 PM > To: lauro.venancio@openbossa.org; > aloisio.almeida@openbossa.org; sameo@linux.intel.com; David > Miller; Elias, Ilan > Cc: linux-kernel@vger.kernel.org; security@kernel.org; > linux-netdev@vger.kernel.org > Subject: [PATCH] NFC: prevent multiple buffer overflows in NCI > > Fix multiple remotely-exploitable stack-based buffer > overflows due to the NCI > code pulling length fields directly from incoming frames and > copying too much > data into statically-sized arrays. Fortunately, there don't > appear to be any > active users of this code (yet). > > This patch fixes the overflows, but I suspect the code will need to be > completely reworked since this doesn't address the more > systemic problem of > failing to check that the values read from incoming frame > data aren't from > beyond the end of the pulled skb data. Build tested only. > > Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com> > Cc: stable@kernel.org > Cc: security@kernel.org > Cc: Lauro Ramos Venancio <lauro.venancio@openbossa.org> > Cc: Aloisio Almeida Jr <aloisio.almeida@openbossa.org> > Cc: Samuel Ortiz <sameo@linux.intel.com> > Cc: David S. Miller <davem@davemloft.net> > Cc: Ilan Elias <ilane@ti.com> Acked-by: Ilan Elias <ilane@ti.com>
Thanks & BR, Ilan
| |