Description of problem: When transmitting L2TP frames, we derive the outgoing interface's UDP checksum hardware assist capabilities from the tunnel dst dev. This can sometimes be NULL, especially when routing protocols are used and routing changes occur. This patch just checks for NULL dst or dev pointers when checking for netdev hardware assist features. BUG: unable to handle kernel NULL pointer dereference at 0000000c IP: [<f89d074c>] pppol2tpxmit+0x341/0x4da [pppol2tp] pde = 00000000 Oops: 0000 [#1] SMP last sysfs file: /sys/class/net/lo/operstate Modules linked in: pppol2tp pppox pppgeneric slhc ipv6 dummy loop sndhdacodecatihdmi sndhdaintel sndhdacodec snd [...] Code: 8d 45 08 f0 ff 45 08 89 6b 08 c7 43 68 7e fb 9c f8 8a 45 24 83 e0 0c 3c 04 75 09 80 63 64 f3 e9 b4 00 00 00 8b 43 1 EIP: [<f89d074c>] pppol2tpxmit+0x341/0x4da [pppol2tp] SS:ESP 0068:f70a9cac CR2: 000000000000000c
Introduced in ffcebb16 (v2.6.29-rc1~581), fixed in 3feec909 (fixed in v2.6.34-rc2).
Upstream commit: http://git.kernel.org/linus/ffcebb16 http://git.kernel.org/linus/3feec909
Description of problem: 1. CVE-2010-2537 - The BTRFSIOCCLONE and BTRFSIOCCLONERANGE ioctls should check whether the donor file is append-only before writing to it.
2. CVE-2010-2538 - The BTRFSIOCCLONERANGE ioctl appears to have an integer overflow that allows a user to specify an out-of-bounds range to copy from the source file (if off + len wraps around).
Upstream commit: http://git.kernel.org/linus/2ebc3464781ad24474abcbd2274e6254689853b5
Reference: https://btrfs.wiki.kernel.org/index.php/MainPage
The kernel in Red Hat Enterprise Linux 6 has support for Btrfs by default.
Description of problem: CVE-2007-4573 regression
Reintroduced in v2.6.27-rc1 via commit d4d67150.
Upstream commits: http://git.kernel.org/linus/36d001c70d8a0144ac1d038f6876c484849a74de http://git.kernel.org/linus/eefdca043e8391dcd719711716492063030b55ac
References: http://sota.gen.nz/compat2/
Acknowledgements:
Red Hat would like to thank Ben Hawkes for reporting this issue.
The base-files package before 5.0.0ubuntu7.1 on Ubuntu 9.10 and before 5.0.0ubuntu20.10.04.2 on Ubuntu 10.04 LTS, as shipped on Dell Latitude 2110 netbooks, does not require authentication for package installation, which allows remote archive servers and man-in-the-middle attackers to execute arbitrary code via a crafted package.
Heap-based buffer overflow in pcrecompile.c in the Perl-Compatible Regular Expression (PCRE) library 7.7 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a regular expression that begins with an option and contains multiple branches.
The connector layer in the Linux kernel before 2.6.31.5 does not require the CAPSYSADMIN capability for certain interaction with the (1) uvesafb, (2) pohmelfs, (3) dst, or (4) dm subsystem, which allows local users to bypass intended access restrictions and gain privileges via calls to functions in these subsystems.
Buffer overflow in ftmulti.c in the ftmulti demo program in FreeType before 2.4.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.