diff options
| author | Matt Mackall <mpm@selenic.com> | 2007-07-15 17:10:14 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2007-08-15 09:25:09 -0700 |
| commit | c712842ef701361ed3ee0f50f15797d7369b6628 (patch) | |
| tree | b60cdfdcf3481f42ba94e8640cc37b2db3b55d9f /scripts/patch-kernel | |
| parent | 8adcb4c72176a326b61bbc0a7924d869e52cb116 (diff) | |
random: fix bound check ordering (CVE-2007-3105)
If root raised the default wakeup threshold over the size of the
output pool, the pool transfer function could overflow the stack with
RNG bytes, causing a DoS or potential privilege escalation.
(Bug reported by the PaX Team <pageexec@freemail.hu>)
Cc: Theodore Tso <tytso@mit.edu>
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: Matt Mackall <mpm@selenic.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'scripts/patch-kernel')
0 files changed, 0 insertions, 0 deletions