CVE-2010-3067: Integer Overflow

First published: Thu Sep 02 2010(Updated: )

Description of problem: This doesn't look correct, the io_submit systemcall calls do_io_submit() directly: SYSCALL_DEFINE3(io_submit, aio_context_t, ctx_id, long, nr, struct iocb __user * __user *, iocbpp) { return do_io_submit(ctx_id, nr, iocbpp, 0); } do_io_submit only checks if nr < 0, but doesnt check if the access_ok multiplication will overflow. long do_io_submit(aio_context_t ctx_id, long nr, struct iocb __user *__user *iocbpp, bool compat) { ... if (unlikely(!access_ok(VERIFY_READ, iocbpp, (nr*sizeof(*iocbpp))))) return -EFAULT; ... Then it uses this loop with __get_user_nocheck(), which doesn't look safe. ... for (i=0; i<nr; i++) { struct iocb __user *user_iocb; struct iocb tmp; if (unlikely(__get_user(user_iocb, iocbpp + i))) { ret = -EFAULT; break; } ... Acknowledgements: Red Hat would like to thank Tavis Ormandy for reporting this issue.

Credit: secalert@redhat.com secalert@redhat.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/type
• agent/first-publish-date
• agent/remedy
• collector/launchpad-cve
• source/Launchpad
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2010-3067
• agent/author
• collector/security-tracker-debian
• source/Debian
• agent/software-canonical-lookup
• agent/severity
• agent/weakness
• collector/nvd-historical
• agent/software-canonical-lookup-request
• collector/nvd-index
• collector/usn-cve
• source/Ubuntu
• agent/references
• agent/event
• agent/softwarecombine
• agent/tags
• agent/description
• collector/nvd-cve
• source/NVD
• agent/last-modified-date
• agent/trending
• package-manager/debian
• vendor/linux
• canonical/linux linux kernel
• version/linux linux kernel/2.6.36-rc2
• version/linux linux kernel/2.6.36-rc1
• version/linux linux kernel/2.6.36-rc3
• version/linux linux kernel/2.6.36
• vendor/suse
• canonical/suse linux enterprise server
• version/suse linux enterprise server/10-sp3
• version/suse linux enterprise server/9
• vendor/opensuse
• canonical/opensuse opensuse
• version/opensuse opensuse/11.2
• version/opensuse opensuse/11.3
• canonical/suse linux enterprise desktop
• version/suse linux enterprise desktop/10-sp3
• canonical/suse linux enterprise software development kit
• version/suse linux enterprise software development kit/10-sp3
• canonical/suse linux enterprise real time extension
• version/suse linux enterprise real time extension/11-sp1
• vendor/debian
• canonical/debian debian linux
• version/debian debian linux/5.0
• vendor/canonical
• canonical/canonical ubuntu linux
• version/canonical ubuntu linux/10.10
• version/canonical ubuntu linux/9.04
• version/canonical ubuntu linux/9.10
• version/canonical ubuntu linux/8.04
• version/canonical ubuntu linux/10.04
• version/canonical ubuntu linux/6.06