Messages in this thread | | | Subject | Re: [PATCH] Bluetooth: hidp: fix buffer overflow | From | Marcel Holtmann <> | Date | Tue, 23 Apr 2019 19:04:58 +0200 |
| |
Hi Young,
> Struct ca is copied from userspace. It is not checked whether the "name" > field is NULL terminated, which allows local users to obtain potentially > sensitive information from kernel stack memory, via a HIDPCONNADD command. > > This vulnerability is similar to CVE-2011-1079. > > Signed-off-by: Young Xiao <YangX92@hotmail.com> > --- > net/bluetooth/hidp/sock.c | 1 + > 1 file changed, 1 insertion(+)
patch has been applied to bluetooth-next tree.
Regards
Marcel
| |