linux-kernel - RE: [PATCH] NFC: prevent multiple buffer overflows in NCI

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Sun, 24 Jun 2012 07:50:05 +0000
From:	"Elias, Ilan" <ilane@...com>
To:	Dan Rosenberg <dan.j.rosenberg@...il.com>,
	"lauro.venancio@...nbossa.org" <lauro.venancio@...nbossa.org>,
	"aloisio.almeida@...nbossa.org" <aloisio.almeida@...nbossa.org>,
	"sameo@...ux.intel.com" <sameo@...ux.intel.com>,
	David Miller <davem@...emloft.net>
CC:	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"security@...nel.org" <security@...nel.org>,
	"linux-netdev@...r.kernel.org" <linux-netdev@...r.kernel.org>
Subject: RE: [PATCH] NFC: prevent multiple buffer overflows in NCI

Hi Dan,  

> From: Dan Rosenberg [mailto:dan.j.rosenberg@...il.com] 
> Sent: Thursday, June 21, 2012 10:56 PM
> To: lauro.venancio@...nbossa.org; 
> aloisio.almeida@...nbossa.org; sameo@...ux.intel.com; David 
> Miller; Elias, Ilan
> Cc: linux-kernel@...r.kernel.org; security@...nel.org; 
> linux-netdev@...r.kernel.org
> Subject: [PATCH] NFC: prevent multiple buffer overflows in NCI
> 
> Fix multiple remotely-exploitable stack-based buffer 
> overflows due to the NCI
> code pulling length fields directly from incoming frames and 
> copying too much
> data into statically-sized arrays. Fortunately, there don't 
> appear to be any
> active users of this code (yet).
> 
> This patch fixes the overflows, but I suspect the code will need to be
> completely reworked since this doesn't address the more 
> systemic problem of
> failing to check that the values read from incoming frame 
> data aren't from
> beyond the end of the pulled skb data. Build tested only.
> 
> Signed-off-by: Dan Rosenberg <dan.j.rosenberg@...il.com>
> Cc: stable@...nel.org
> Cc: security@...nel.org
> Cc: Lauro Ramos Venancio <lauro.venancio@...nbossa.org>
> Cc: Aloisio Almeida Jr <aloisio.almeida@...nbossa.org>
> Cc: Samuel Ortiz <sameo@...ux.intel.com>
> Cc: David S. Miller <davem@...emloft.net>
> Cc: Ilan Elias <ilane@...com>
Acked-by: Ilan Elias <ilane@...com>

Thanks & BR,
Ilan
 --
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/