Description of problem: When transmitting L2TP frames, we derive the outgoing interface's UDP checksum hardware assist capabilities from the tunnel dst dev. This can sometimes be NULL, especially when routing protocols are used and routing changes occur. This patch just checks for NULL dst or dev pointers when checking for netdev hardware assist features. BUG: unable to handle kernel NULL pointer dereference at 0000000c IP: [<f89d074c>] pppol2tpxmit+0x341/0x4da [pppol2tp] pde = 00000000 Oops: 0000 [#1] SMP last sysfs file: /sys/class/net/lo/operstate Modules linked in: pppol2tp pppox pppgeneric slhc ipv6 dummy loop sndhdacodecatihdmi sndhdaintel sndhdacodec snd [...] Code: 8d 45 08 f0 ff 45 08 89 6b 08 c7 43 68 7e fb 9c f8 8a 45 24 83 e0 0c 3c 04 75 09 80 63 64 f3 e9 b4 00 00 00 8b 43 1 EIP: [<f89d074c>] pppol2tpxmit+0x341/0x4da [pppol2tp] SS:ESP 0068:f70a9cac CR2: 000000000000000c
Introduced in ffcebb16 (v2.6.29-rc1~581), fixed in 3feec909 (fixed in v2.6.34-rc2).
Upstream commit: http://git.kernel.org/linus/ffcebb16 http://git.kernel.org/linus/3feec909
The connector layer in the Linux kernel before 2.6.31.5 does not require the CAPSYSADMIN capability for certain interaction with the (1) uvesafb, (2) pohmelfs, (3) dst, or (4) dm subsystem, which allows local users to bypass intended access restrictions and gain privileges via calls to functions in these subsystems.
The Linux kernel before 2.6.31-rc7 does not initialize certain data structures within getname functions, which allows local users to read the contents of some kernel memory locations by calling getsockname on (1) an AFAPPLETALK socket, related to the atalkgetname function in net/appletalk/ddp.c; (2) an AFIRDA socket, related to the irdagetname function in net/irda/afirda.c; (3) an AFECONET socket, related to the econetgetname function in net/econet/afeconet.c; (4) an AFNETROM socket, related to the nrgetname function in net/netrom/afnetrom.c; (5) an AFROSE socket, related to the rosegetname function in net/rose/afrose.c; or (6) a raw CAN socket, related to the rawgetname function in net/can/raw.c.
Description of problem: 1) NET: llc, zero sockaddrllc struct sllcarphrd member of sockaddrllc might not be changed. Zero sllc before copying to the above layer's structure.
http://git.kernel.org/linus/3480c63bdf008e9289aab94418f43b9592978fff http://git.kernel.org/linus/28e9fc592cb8c7a43e4d3147b38be6032a0e81bc http://milw0rm.com/exploits/9513
Note that LLC sockets are restricted to root since v2.6.25-rc9 (see commit 3480c63b).
2) can: Fix rawgetname() leak rawgetname() can leak 10 bytes of kernel memory to user
http://git.kernel.org/linus/e84b90ae5eb3c112d1f208964df1d8156a538289
Note that this was introduced in v2.6.25-rc1.
3) irda: Fix irdagetname() leak irdagetname() can leak kernel memory to user.
http://git.kernel.org/linus/09384dfc76e526c3993c09c42e016372dc9dd22c
4) appletalk: fix atalkgetname() leak atalkgetname() can leak 8 bytes of kernel memory to user
http://git.kernel.org/linus/3d392475c873c10c10d6d96b94d092a34ebd4791 http://milw0rm.com/exploits/9521
5) netrom: Fix nrgetname() leak nrgetname() can leak kernel memory to user.
http://git.kernel.org/linus/f6b97b29513950bfbf621a83d85b6f86b39ec8db
6) econet: Fix econetgetname() leak econetgetname() can leak kernel memory to user.
http://git.kernel.org/linus/80922bbb12a105f858a8f0abb879cb4302d0ecaa
7) rose: Fix rosegetname() leak rosegetname() can leak kernel memory to user.
http://git.kernel.org/linus/17ac2e9c58b69a1e25460a568eae1b0dc0188c25
CVE request: http://article.gmane.org/gmane.comp.security.oss.general/2029 http://article.gmane.org/gmane.comp.security.oss.general/2033
The Ubuntu clamav-milter.init script in clamav-milter before 0.95.1+dfsg-1ubuntu1.2 in Ubuntu 9.04 sets the ownership of the current working directory to the clamav account, which might allow local users to bypass intended access restrictions via read or write operations involving this directory.
Buffer overflow in ftmulti.c in the ftmulti demo program in FreeType before 2.4.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.