On Tue, 21 Jul 2009, Michael Buesch wrote: > Avoid a heap buffer overrun triggered by an integer overflow of the userspace > controlled "count" variable. > If userspace passes in a "count" of (size_t)-1l, the kmalloc size will overflow > to ((size_t)-1l + 2) = 1, so only one byte will be allocated. However, copy_from_user() > will attempt to copy 0xFFFFFFFF (or 0xFFFFFFFFFFFFFFFF on 64bit) bytes to the buffer. Good catch. Thank you! Patch acked, and queued. I am sending it to Len Brown now (although I think he is taking his post-rc2 time off, so it might take a week or so for it to be sent to Linus). It is a security hole alright, and while it is NOT open in a default configuration, it CAN be used for local priviledge escalation on any system where the distro or the local administratior used chown() or chmod() to unrestrict access to /proc/acpi/ibm/*. The code in question is in mainline since 2.6.12, and maybe even earlier. Argh. -- "One disk to rule them all, One disk to find them. One disk to bring them all and in the darkness grind them. In the Land of Redmond where the shadows lie." -- The Silicon Valley Tarot Henrique Holschuh ------------------------------------------------------------------------------ _______________________________________________ ibm-acpi-devel mailing list ibm-acpi-devel@xxxxxxxxxxxxxxxxxxxxx https://lists.sourceforge.net/lists/listinfo/ibm-acpi-devel
