fs/jfs/xattr.c in the Linux kernel before 2.6.35.2 does not properly handle a certain legacy format for storage of extended attributes, which might allow local users by bypass intended xattr namespace restrictions via an "os2." substring at the beginning of a name.
Description of problem: This problem was originally tracked down by Brad Spengler.
When calling wireless ioctls, if a driver does not correctly validate/shrink iwp->length, the resulting copytouser can leak up to 64K of kernel heap contents.
It seems that this is triggerable[1] in 2.6.32 at least on ath5k, but I was not able to track down how. The twisty maze of ioctl handlers stumped me. :) Other drivers I checked did not appear to have any problems, but the potential remains. I'm not sure if this patch is the right approach; it was fixed differently[2] in grsecurity.
[1] http://forums.grsecurity.net/viewtopic.php?f=3&t=2290&start=0 [2] http://grsecurity.net/~spender/wireless-infoleak-fix2.patch
Discussion: http://lkml.org/lkml/2010/8/27/413
Description of problem: The old shm interface allows unprivileged users to read uninitialized stack memory, because shmidds structure declared on the stack is not altered or zeroed before being copied back to the user.
Reference: http://www.openwall.com/lists/oss-security/2010/10/07/1 http://lkml.org/lkml/2010/10/6/454
Acknowledgements:
Red Hat would like to thank Vasiliy Kulikov of Openwall and Kees Cook for reporting this issue.
Last updated 24 July 2024
Last updated 24 July 2024
Description of problem: http://lkml.org/lkml/2010/9/11/168 The EQLGETMASTRCFG device ioctl allows unprivileged users to read 16 bytes of uninitialized stack memory, because the "mastername" member of the masterconfigt struct declared on the stack in eqlgmastercfg() is not altered or zeroed before being copied back to the user.
Acknowledgements:
Red Hat would like to thank Dan Rosenberg for reporting this issue.
Description of problem: http://lkml.org/lkml/2010/9/11/170 The CHELSIOGETQSETNUM device ioctl allows unprivileged users to read 4 bytes of uninitialized stack memory, because the "addr" member of the chreg struct declared on the stack in cxgbextensionioctl() is not altered or zeroed before being copied back to the user.
Acknowledgements:
Red Hat would like to thank Dan Rosenberg for reporting this issue.
Description of problem: http://lkml.org/lkml/2010/9/11/167
The TIOCGICOUNT device ioctl allows unprivileged users to read 9 bytes of uninitialized stack memory, because the "reserved" member of the serialicounterstruct struct declared on the stack in hsogetcount() is not altered or zeroed before being copied back to the user. This patch takes care of it.
Acknowledgements:
Red Hat would like to thank Dan Rosenberg for reporting this issue.
Last updated 24 July 2024
Description of problem: Calling ETHTOOLGRXCLSRLALL with a large rulecnt will allocate kernel heap without clearing it. For the one driver (niu) that implements it, it will leave the unused portion of heap unchanged and copy the full contents back to userspace.
This is different from CVE-2010-2478, but was introduced at the same time (0853ad66, 2.6.27-rc1).
Upstream commit: http://git.kernel.org/linus/ae6df5f96a51818d6376da5307d773baeece4014
Acknowledgements:
Red Hat would like to thank Kees Cook for reporting this issue.
Description of problem: User "foo" can use the SWAPEXT ioctl to swap a write-only file owned by user "bar" into a file owned by "foo" and subsequently reading it. It does so by checking that the file descriptors passed to the ioctl are also opened for reading.
References: http://archives.free.net.ph/message/20100616.130710.301704aa.en.html http://archives.free.net.ph/message/20100616.135735.40f53a32.en.html