On Wed, 16 May 2012, David Miller wrote: > > Could at least the patch with the subject > > > > netfilter: ipset: fix hash size checking in kernel > > > > The hash size must fit both into u32 (jhash) and the max value of > > size_t. The missing checking could lead to kernel crash, bug reported > > by Seblu. > > > > be submitted into 3.4-rc7? Any non most-recent ipset package compiled with > > gcc-4.7 or above can trigger the bug. > > And only root can trigger it if he gives bogus parameters right? Yes, root can trigger it only, however it's a two sided bug: ipset < 6.12 compiled with gcc >= 4.7 is broken and sends bogus data to the kernel, even when normal input parameters are supplied. And unpatched kernel can crash when acting on the bogus data. :-( > If that's the case, the exposure is to privileged users committing an > operator error, so I don't see it as so important. Best regards, Jozsef - E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlecsik.jozsef@xxxxxxxxxxxxx PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences H-1525 Budapest 114, POB. 49, Hungary -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
