lkml.org 
[lkml]   [2012]   [Jun]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRE: [PATCH] NFC: prevent multiple buffer overflows in NCI
    Date
    Hi Dan,  

    > From: Dan Rosenberg [mailto:dan.j.rosenberg@gmail.com]
    > Sent: Thursday, June 21, 2012 10:56 PM
    > To: lauro.venancio@openbossa.org;
    > aloisio.almeida@openbossa.org; sameo@linux.intel.com; David
    > Miller; Elias, Ilan
    > Cc: linux-kernel@vger.kernel.org; security@kernel.org;
    > linux-netdev@vger.kernel.org
    > Subject: [PATCH] NFC: prevent multiple buffer overflows in NCI
    >
    > Fix multiple remotely-exploitable stack-based buffer
    > overflows due to the NCI
    > code pulling length fields directly from incoming frames and
    > copying too much
    > data into statically-sized arrays. Fortunately, there don't
    > appear to be any
    > active users of this code (yet).
    >
    > This patch fixes the overflows, but I suspect the code will need to be
    > completely reworked since this doesn't address the more
    > systemic problem of
    > failing to check that the values read from incoming frame
    > data aren't from
    > beyond the end of the pulled skb data. Build tested only.
    >
    > Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
    > Cc: stable@kernel.org
    > Cc: security@kernel.org
    > Cc: Lauro Ramos Venancio <lauro.venancio@openbossa.org>
    > Cc: Aloisio Almeida Jr <aloisio.almeida@openbossa.org>
    > Cc: Samuel Ortiz <sameo@linux.intel.com>
    > Cc: David S. Miller <davem@davemloft.net>
    > Cc: Ilan Elias <ilane@ti.com>
    Acked-by: Ilan Elias <ilane@ti.com>

    Thanks & BR,
    Ilan


    \
     
     \ /
      Last update: 2012-06-24 10:21    [W:4.320 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site