linux-kernel - Re: [Stable-review] [087/165] Fix for buffer overflow in ldm_frag_add not sufficient

Open Source and information security mailing list archives

Message-ID: <1307068289.22348.42.camel@localhost>
Date:	Fri, 03 Jun 2011 03:31:29 +0100
From:	Ben Hutchings <ben@...adent.org.uk>
To:	Greg KH <gregkh@...e.de>
Cc:	linux-kernel@...r.kernel.org, stable@...nel.org,
	Timo Warns <warns@...-sense.de>, akpm@...ux-foundation.org,
	torvalds@...ux-foundation.org, stable-review@...nel.org,
	alan@...rguk.ukuu.org.uk
Subject: Re: [Stable-review] [087/165] Fix for buffer overflow in
 ldm_frag_add not sufficient

On Wed, 2011-06-01 at 17:10 +0900, Greg KH wrote:
> 2.6.39-stable review patch.  If anyone has any objections, please let us know.
> 
> ------------------
> Content-Length: 1139
> Lines: 36
> 
> From: Timo Warns <Warns@...-sense.de>
> 
> commit cae13fe4cc3f24820ffb990c09110626837e85d4 upstream.
> 
> As Ben Hutchings discovered [1], the patch for CVE-2011-1017 (buffer
> overflow in ldm_frag_add) is not sufficient.  The original patch in
> commit c340b1d64000 ("fs/partitions/ldm.c: fix oops caused by corrupted
> partition table") does not consider that, for subsequent fragments,
> previously allocated memory is used.
> 
> [1] http://lkml.org/lkml/2011/5/6/407

I still assert that the function is broken because the fragments are
copied to incorrect offsets.  However, this change should at least make
it *harmless* junk.

Ben.

> Reported-by: Ben Hutchings <ben@...adent.org.uk>
> Signed-off-by: Timo Warns <warns@...-sense.de>
> Signed-off-by: Linus Torvalds <torvalds@...ux-foundation.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@...e.de>
> 
> ---
>  fs/partitions/ldm.c |    5 +++++
>  1 file changed, 5 insertions(+)
> 
> --- a/fs/partitions/ldm.c
> +++ b/fs/partitions/ldm.c
> @@ -1335,6 +1335,11 @@ static bool ldm_frag_add (const u8 *data
>  
>  	list_add_tail (&f->list, frags);
>  found:
> +	if (rec >= f->num) {
> +		ldm_error("REC value (%d) exceeds NUM value (%d)", rec, f->num);
> +		return false;
> +	}
> +
>  	if (f->map & (1 << rec)) {
>  		ldm_error ("Duplicate VBLK, part %d.", rec);
>  		f->map &= 0x7F;			/* Mark the group as broken */
> 
> 
> _______________________________________________
> Stable-review mailing list
> Stable-review@...ux.kernel.org
> http://linux.kernel.org/mailman/listinfo/stable-review
> 

-- 
Ben Hutchings
Once a job is fouled up, anything done to improve it makes it worse.

Download attachment "signature.asc" of type "application/pgp-signature" (829 bytes)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives