lkml.org 
[lkml]   [2012]   [Jun]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRE: [PATCH] NFC: prevent multiple buffer overflows in NCI
Date
Hi Dan,  

> From: Dan Rosenberg [mailto:dan.j.rosenberg@gmail.com]
> Sent: Thursday, June 21, 2012 10:56 PM
> To: lauro.venancio@openbossa.org;
> aloisio.almeida@openbossa.org; sameo@linux.intel.com; David
> Miller; Elias, Ilan
> Cc: linux-kernel@vger.kernel.org; security@kernel.org;
> linux-netdev@vger.kernel.org
> Subject: [PATCH] NFC: prevent multiple buffer overflows in NCI
>
> Fix multiple remotely-exploitable stack-based buffer
> overflows due to the NCI
> code pulling length fields directly from incoming frames and
> copying too much
> data into statically-sized arrays. Fortunately, there don't
> appear to be any
> active users of this code (yet).
>
> This patch fixes the overflows, but I suspect the code will need to be
> completely reworked since this doesn't address the more
> systemic problem of
> failing to check that the values read from incoming frame
> data aren't from
> beyond the end of the pulled skb data. Build tested only.
>
> Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
> Cc: stable@kernel.org
> Cc: security@kernel.org
> Cc: Lauro Ramos Venancio <lauro.venancio@openbossa.org>
> Cc: Aloisio Almeida Jr <aloisio.almeida@openbossa.org>
> Cc: Samuel Ortiz <sameo@linux.intel.com>
> Cc: David S. Miller <davem@davemloft.net>
> Cc: Ilan Elias <ilane@ti.com>
Acked-by: Ilan Elias <ilane@ti.com>

Thanks & BR,
Ilan


\
 
 \ /
  Last update: 2012-06-24 10:21    [W:0.092 / U:0.172 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site