** Also affects: linux (Ubuntu Xenial)
Importance: Undecided
Status: Confirmed
** Also affects: linux (Ubuntu Wily)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu Xenial)
Status: Confirmed => In Progress
** Changed in: linux (Ubuntu Xenial)
Assignee: (unassigned) => Tim Gardner (timg-tpi)
--
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1555353
Title:
integer overflow in xt_alloc_table_info
Status in linux package in Ubuntu:
In Progress
Status in linux source package in Wily:
New
Status in linux source package in Xenial:
In Progress
Bug description:
[From https://code.google.com/p/google-security-
research/issues/detail?id=758 ]
A recent refactoring cof this codepath
(https://github.com/torvalds/linux/commit/2e4e6a17af35be359cc8f1c924f8f198fbd478cc)
introduced an integer overflow in xt_alloc_table_info, which on 32-bit
systems can lead to small structure allocation and a copy_from_user
based heap corruption.
More specifically, the overflow may have been introduced in
https://github.com/torvalds/linux/commit/711bdde6a884354ddae8da2fcb495b2a9364cc90
; specifically the bit:
+ size_t sz = sizeof(*info) + size;
(where size is an unsigned int passed from userspace).
This issue should only affect 32bit platforms (xt_table_info.size is
an unsigned int).
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1555353/+subscriptions
--
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help : https://help.launchpad.net/ListHelp
