oss-sec mailing list archives
Re: CVE request: kernel: remote buffer overflow in bluetooth
From: Eugene Teo <eugene () redhat com>
Date: Mon, 27 Jun 2011 11:22:36 +0800
On 06/25/2011 07:15 AM, Dan Rosenberg wrote:
A remote user can provide a small value for the command size field in the command header of an l2cap configuration request, resulting in an integer underflow when subtracting the size of the configuration request header. This results in copying a very large amount of data via memcpy() and destroying the kernel heap. [1] -Dan [1] http://marc.info/?l=linux-kernel&m=130891911909436&w=2
Please use CVE-2011-2497. Eugene
Current thread:
- CVE request: kernel: remote buffer overflow in bluetooth Dan Rosenberg (Jun 24)
- Re: CVE request: kernel: remote buffer overflow in bluetooth Eugene Teo (Jun 26)