diff options
| author | Dan Rosenberg <drosenberg@vsecurity.com> | 2011-04-05 12:45:59 -0400 |
|---|---|---|
| committer | Paul Gortmaker <paul.gortmaker@windriver.com> | 2011-06-26 12:47:15 -0400 |
| commit | edcbb9264551ab263e5be3498f2208659a5c74e8 (patch) | |
| tree | af022ccb0f6b1565044ae52831886bf274d0061b /drivers/usb/core | |
| parent | 814ce791d089f872b3c57a5b1adf55b12c67fad2 (diff) | |
mpt2sas: prevent heap overflows and unchecked reads
commit a1f74ae82d133ebb2aabb19d181944b4e83e9960 upstream.
At two points in handling device ioctls via /dev/mpt2ctl, user-supplied
length values are used to copy data from userspace into heap buffers
without bounds checking, allowing controllable heap corruption and
subsequently privilege escalation.
Additionally, user-supplied values are used to determine the size of a
copy_to_user() as well as the offset into the buffer to be read, with no
bounds checking, allowing users to read arbitrary kernel memory.
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Acked-by: Eric Moore <eric.moore@lsi.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Diffstat (limited to 'drivers/usb/core')
0 files changed, 0 insertions, 0 deletions