[kernel] r17128 - in dists/squeeze/linux-2.6/debian: . patches/bugfix/all patches/series

[Dann Frazier]

Author: dannf
Date: Sun Mar 27 21:52:12 2011
New Revision: 17128

Log:
Bluetooth: bnep: fix buffer overflow (CVE-2010-1079)

Added:
   dists/squeeze/linux-2.6/debian/patches/bugfix/all/bluetooth-bnep-fix-buffer-overflow.patch
Modified:
   dists/squeeze/linux-2.6/debian/changelog
   dists/squeeze/linux-2.6/debian/patches/series/32

Modified: dists/squeeze/linux-2.6/debian/changelog
==============================================================================
--- dists/squeeze/linux-2.6/debian/changelog	Sun Mar 27 21:44:42 2011	(r17127)
+++ dists/squeeze/linux-2.6/debian/changelog	Sun Mar 27 21:52:12 2011	(r17128)
@@ -49,6 +49,7 @@
      http://www.kernel.org/pub/linux/kernel/v2.6/longterm/v2.6.32/ChangeLog-2.6.32.35
   * drm/radeon/kms: check AA resolve registers on r300 (CVE-2011-1016)
   * Bluetooth: sco: fix information leak to userspace (CVE-2011-1078)
+  * Bluetooth: bnep: fix buffer overflow (CVE-2010-1079)
 
  -- Ben Hutchings <ben at decadent.org.uk>  Sat, 12 Mar 2011 20:20:58 +0000
 

Added: dists/squeeze/linux-2.6/debian/patches/bugfix/all/bluetooth-bnep-fix-buffer-overflow.patch
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ dists/squeeze/linux-2.6/debian/patches/bugfix/all/bluetooth-bnep-fix-buffer-overflow.patch	Sun Mar 27 21:52:12 2011	(r17128)
@@ -0,0 +1,26 @@
+commit 43629f8f5ea32a998d06d1bb41eefa0e821ff573
+Author: Vasiliy Kulikov <segoon at openwall.com>
+Date:   Mon Feb 14 13:54:31 2011 +0300
+
+    Bluetooth: bnep: fix buffer overflow
+    
+    Struct ca is copied from userspace.  It is not checked whether the "device"
+    field is NULL terminated.  This potentially leads to BUG() inside of
+    alloc_netdev_mqs() and/or information leak by creating a device with a name
+    made of contents of kernel stack.
+    
+    Signed-off-by: Vasiliy Kulikov <segoon at openwall.com>
+    Signed-off-by: Gustavo F. Padovan <padovan at profusion.mobi>
+
+diff --git a/net/bluetooth/bnep/sock.c b/net/bluetooth/bnep/sock.c
+index 2862f53..d935da7 100644
+--- a/net/bluetooth/bnep/sock.c
++++ b/net/bluetooth/bnep/sock.c
+@@ -88,6 +88,7 @@ static int bnep_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
+ 			sockfd_put(nsock);
+ 			return -EBADFD;
+ 		}
++		ca.device[sizeof(ca.device)-1] = 0;
+ 
+ 		err = bnep_add_connection(&ca, nsock);
+ 		if (!err) {

Modified: dists/squeeze/linux-2.6/debian/patches/series/32
==============================================================================
--- dists/squeeze/linux-2.6/debian/patches/series/32	Sun Mar 27 21:44:42 2011	(r17127)
+++ dists/squeeze/linux-2.6/debian/patches/series/32	Sun Mar 27 21:52:12 2011	(r17128)
@@ -16,3 +16,4 @@
 + bugfix/all/drm-radeon-fix-regression-with-aa-resolve-checking.patch
 + bugfix/all/stable/2.6.32.36.patch
 + bugfix/all/bluetooth-sco-fix-information-leak-to-userspace.patch
++ bugfix/all/bluetooth-bnep-fix-buffer-overflow.patch