oss-sec mailing list archives
CVE request: kernel: L2TP send buffer allocation size overflows
From: Petr Matousek <pmatouse () redhat com>
Date: Wed, 10 Nov 2010 10:27:46 -0500 (EST)
"Both PPPoL2TP (in net/l2tp/l2tp_ppp.c, pppol2tp_sendmsg()) and IPoL2TP (in net/l2tp/l2tp_ip.c, l2tp_ip_sendmsg()) make calls to sock_wmalloc() that perform arithmetic on the size argument without any maximum bound. As a result, by issuing sendto() calls with very large sizes, this allocation size will wrap and result in a small buffer being allocated, leading to ugliness immediately after (probably kernel panics due to bad sk_buff tail position, but possibly kernel heap corruption)." Credit: Dan Rosenberg Reference: http://www.spinics.net/lists/netdev/msg145673.html https://bugzilla.redhat.com/show_bug.cgi?id=651892 Thanks, -- Petr Matousek / Red Hat Security Response Team
Current thread:
- CVE request: kernel: L2TP send buffer allocation size overflows Petr Matousek (Nov 10)
- Re: CVE request: kernel: L2TP send buffer allocation size overflows Josh Bressers (Nov 10)