lkml.org 
[lkml]   [2014]   [Mar]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH net] vhost: validate vhost_get_vq_desc return value
From
From: "Michael S. Tsirkin" <mst@redhat.com>
Date: Thu, 27 Mar 2014 12:53:37 +0200

> vhost fails to validate negative error code
> from vhost_get_vq_desc causing
> a crash: we are using -EFAULT which is 0xfffffff2
> as vector size, which exceeds the allocated size.
>
> The code in question was introduced in commit
> 8dd014adfea6f173c1ef6378f7e5e7924866c923
> vhost-net: mergeable buffers support
>
> CVE-2014-0055
>
> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
> ---
>
> This is needed in -stable.

Applied and queued up for -stable, thanks Michael.


\
 
 \ /
  Last update: 2014-03-28 21:21    [W:0.018 / U:0.092 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site