Integer overflow in the btrfsioctlclone function in fs/btrfs/ioctl.c in the Linux kernel before 2.6.35 might allow local users to obtain sensitive information via a BTRFSIOCCLONERANGE ioctl call.

Description of problem: 1. CVE-2010-2537 - The BTRFSIOCCLONE and BTRFSIOCCLONERANGE ioctls should check whether the donor file is append-only before writing to it.

2. CVE-2010-2538 - The BTRFSIOCCLONERANGE ioctl appears to have an integer overflow that allows a user to specify an out-of-bounds range to copy from the source file (if off + len wraps around).

Upstream commit: http://git.kernel.org/linus/2ebc3464781ad24474abcbd2274e6254689853b5

Reference: https://btrfs.wiki.kernel.org/index.php/MainPage

The kernel in Red Hat Enterprise Linux 6 has support for Btrfs by default.

Integer overflow in the rdsrdmapages function in net/rds/rdma.c in the Linux kernel allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted iovec struct in a Reliable Datagram Sockets (RDS) request, which triggers a buffer overflow.

Description of problem: If the donor file is an append-only file, we should not allow the operation to proceed, lest we end up overwriting the contents of an append-only file.

Upstream commit: http://git.kernel.org/linus/1f5a81e41f8b1a782c68d3843e9ec1bfaadf7d72

The I/O implementation for block devices in the Linux kernel before 2.6.33 does not properly handle the CLONEIO feature, which allows local users to cause a denial of service (I/O instability) by starting multiple processes that share an I/O context.