On Sun, Oct 09, 2005 at 12:18:54PM +0200, Moritz Muehlenhoff wrote:
> Hi Horms / security team,
> I found three more security related reports/patches on linux-kernel.
As mentioned elsewhere, the first (request_key_auth memleek) is CAN-2005-3119.
Can we get CAN numbers for the other two?
>
> Cheers,
> Moritz
>
> From: David Howells <[EMAIL PROTECTED]>
>
> Plug request_key_auth memleak. This can be triggered by unprivileged
> users, so is local DoS.
>
> Signed-off-by: Chris Wright <[EMAIL PROTECTED]>
> Signed-Off-By: David Howells <[EMAIL PROTECTED]>
> Signed-off-by: Greg Kroah-Hartman <[EMAIL PROTECTED]>
> ---
> security/keys/request_key_auth.c | 1 +
> 1 file changed, 1 insertion(+)
>
> --- linux-2.6.13.y.orig/security/keys/request_key_auth.c
> +++ linux-2.6.13.y/security/keys/request_key_auth.c
> @@ -96,6 +96,7 @@ static void request_key_auth_destroy(str
> kenter("{%d}", key->serial);
>
> key_put(rka->target_key);
> + kfree(rka);
>
> } /* end request_key_auth_destroy() */
>
>
> From: Dave Jones <[EMAIL PROTECTED]>
>
> Please consider for next 2.6.13, it is a minor security issue allowing
> users to turn on drm debugging when they shouldn't...
>
> This fell through the cracks. Until Josh pointed me at
> http://bugs.gentoo.org/show_bug.cgi?id=107893
>
> Signed-off-by: Chris Wright <[EMAIL PROTECTED]>
> Signed-off-by: Greg Kroah-Hartman <[EMAIL PROTECTED]>
> ---
> drivers/char/drm/drm_stub.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> --- linux-2.6.13.y.orig/drivers/char/drm/drm_stub.c
> +++ linux-2.6.13.y/drivers/char/drm/drm_stub.c
> @@ -47,7 +47,7 @@ MODULE_PARM_DESC(cards_limit, "Maximum n
> MODULE_PARM_DESC(debug, "Enable debug output");
>
> module_param_named(cards_limit, drm_cards_limit, int, 0444);
> -module_param_named(debug, drm_debug, int, 0666);
> +module_param_named(debug, drm_debug, int, 0600);
>
> drm_head_t **drm_heads;
> struct drm_sysfs_class *drm_class;
>
>
> From: Pavel Roskin <[EMAIL PROTECTED]>
>
> The orinoco driver can send uninitialized data exposing random pieces of
> the system memory. This happens because data is not padded with zeroes
> when its length needs to be increased.
>
> Reported by Meder Kydyraliev <[EMAIL PROTECTED]>
>
> Signed-off-by: Pavel Roskin <[EMAIL PROTECTED]>
> Signed-off-by: Chris Wright <[EMAIL PROTECTED]>
> Signed-off-by: Greg Kroah-Hartman <[EMAIL PROTECTED]>
> ---
> drivers/net/wireless/orinoco.c | 14 +++++++++-----
> 1 file changed, 9 insertions(+), 5 deletions(-)
>
> --- linux-2.6.13.y.orig/drivers/net/wireless/orinoco.c
> +++ linux-2.6.13.y/drivers/net/wireless/orinoco.c
> @@ -502,9 +502,14 @@ static int orinoco_xmit(struct sk_buff *
> return 0;
> }
>
> - /* Length of the packet body */
> - /* FIXME: what if the skb is smaller than this? */
> - len = max_t(int,skb->len - ETH_HLEN, ETH_ZLEN - ETH_HLEN);
> + /* Check packet length, pad short packets, round up odd length */
> + len = max_t(int, ALIGN(skb->len, 2), ETH_ZLEN);
> + if (skb->len < len) {
> + skb = skb_padto(skb, len);
> + if (skb == NULL)
> + goto fail;
> + }
> + len -= ETH_HLEN;
>
> eh = (struct ethhdr *)skb->data;
>
> @@ -556,8 +561,7 @@ static int orinoco_xmit(struct sk_buff *
> p = skb->data;
> }
>
> - /* Round up for odd length packets */
> - err = hermes_bap_pwrite(hw, USER_BAP, p, ALIGN(data_len, 2),
> + err = hermes_bap_pwrite(hw, USER_BAP, p, data_len,
> txfid, data_off);
> if (err) {
> printk(KERN_ERR "%s: Error %d writing packet to BAP\n",
--
Horms
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
