From patchwork Tue Jul 26 18:51:12 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andy Whitcroft X-Patchwork-Id: 106907 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from chlorine.canonical.com (chlorine.canonical.com [91.189.94.204]) by ozlabs.org (Postfix) with ESMTP id DB50FB6F83 for ; Wed, 27 Jul 2011 04:51:30 +1000 (EST) Received: from localhost ([127.0.0.1] helo=chlorine.canonical.com) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1Qlmiv-0002vq-5s; Tue, 26 Jul 2011 18:51:21 +0000 Received: from adelie.canonical.com ([91.189.90.139]) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1Qlmiq-0002sF-KO for kernel-team@lists.ubuntu.com; Tue, 26 Jul 2011 18:51:16 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by adelie.canonical.com with esmtp (Exim 4.71 #1 (Debian)) id 1Qlmip-0002qr-CD for ; Tue, 26 Jul 2011 18:51:15 +0000 Received: from [85.210.144.167] (helo=localhost.localdomain) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1Qlmip-0002aE-7S for kernel-team@lists.ubuntu.com; Tue, 26 Jul 2011 18:51:15 +0000 From: Andy Whitcroft To: kernel-team@lists.ubuntu.com Subject: [hardy CVE 1/1] Bluetooth: bnep: fix buffer overflow Date: Tue, 26 Jul 2011 19:51:12 +0100 Message-Id: <1311706273-14191-2-git-send-email-apw@canonical.com> X-Mailer: git-send-email 1.7.4.1 In-Reply-To: <1311706273-14191-1-git-send-email-apw@canonical.com> References: <1311706273-14191-1-git-send-email-apw@canonical.com> X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.13 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: kernel-team-bounces@lists.ubuntu.com Errors-To: kernel-team-bounces@lists.ubuntu.com From: Vasiliy Kulikov Struct ca is copied from userspace. It is not checked whether the "device" field is NULL terminated. This potentially leads to BUG() inside of alloc_netdev_mqs() and/or information leak by creating a device with a name made of contents of kernel stack. Signed-off-by: Vasiliy Kulikov Signed-off-by: Gustavo F. Padovan (cherry picked from commit 43629f8f5ea32a998d06d1bb41eefa0e821ff573) CVE-2011-1079 BugLink: http://bugs.launchpad.net/bugs/816544 Signed-off-by: Andy Whitcroft --- net/bluetooth/bnep/sock.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/net/bluetooth/bnep/sock.c b/net/bluetooth/bnep/sock.c index 9ebd3c6..7d31198 100644 --- a/net/bluetooth/bnep/sock.c +++ b/net/bluetooth/bnep/sock.c @@ -97,6 +97,7 @@ static int bnep_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long fput(nsock->file); return -EBADFD; } + ca.device[sizeof(ca.device)-1] = 0; err = bnep_add_connection(&ca, nsock); if (!err) {