On 08/14/2016 10:44 AM, Greg Kroah-Hartman wrote:
On Mon, Jul 18, 2016 at 04:53:19PM -0400, Charles (Chas) Williams wrote:
From: Kangjie Lu <kangjielu@xxxxxxxxx>
commit 681fef8380eb818c0b845fca5d2ab1dcbab114ee upstream.
The stack object “ci” has a total size of 8 bytes. Its last 3 bytes
are padding bytes which are not initialized and leaked to userland
via “copy_to_user”.
CVE-2016-4482
Signed-off-by: Kangjie Lu <kjlu@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
[ciwillia@xxxxxxxxxxx: backported to 3.14: adjusted context]
Signed-off-by: Charles (Chas) Williams <ciwillia@xxxxxxxxxxx>
---
drivers/usb/core/devio.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
Another one not in 4.4 :(
I swear I sent this earlier. It's on my update branch. I can't to
get to the list archive at the moment to check.
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html