[kernel] r17288 - in dists/squeeze/linux-2.6/debian: . patches/bugfix/all patches/series
Dann Frazier
dannf at alioth.debian.org
Tue May 3 05:58:26 UTC 2011
Author: dannf
Date: Tue May 3 05:58:24 2011
New Revision: 17288
Log:
mpt2sas: prevent heap overflows and unchecked reads (CVE-2011-1494)
Added:
dists/squeeze/linux-2.6/debian/patches/bugfix/all/mpt2sas-prevent-heap-overflows-and-unchecked-reads.patch
Modified:
dists/squeeze/linux-2.6/debian/changelog
dists/squeeze/linux-2.6/debian/patches/series/34
Modified: dists/squeeze/linux-2.6/debian/changelog
==============================================================================
--- dists/squeeze/linux-2.6/debian/changelog Tue May 3 05:58:15 2011 (r17287)
+++ dists/squeeze/linux-2.6/debian/changelog Tue May 3 05:58:24 2011 (r17288)
@@ -66,6 +66,7 @@
* Revert AMD deep C changes from 2.6.32.39
* fs/partitions/ldm.c: fix oops caused by corrupted partition table
(CVE-2011-1017)
+ * mpt2sas: prevent heap overflows and unchecked reads (CVE-2011-1494)
-- Ben Hutchings <ben at decadent.org.uk> Fri, 08 Apr 2011 01:13:01 +0100
Added: dists/squeeze/linux-2.6/debian/patches/bugfix/all/mpt2sas-prevent-heap-overflows-and-unchecked-reads.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/squeeze/linux-2.6/debian/patches/bugfix/all/mpt2sas-prevent-heap-overflows-and-unchecked-reads.patch Tue May 3 05:58:24 2011 (r17288)
@@ -0,0 +1,81 @@
+commit a1f74ae82d133ebb2aabb19d181944b4e83e9960
+Author: Dan Rosenberg <drosenberg at vsecurity.com>
+Date: Tue Apr 5 12:45:59 2011 -0400
+
+ [SCSI] mpt2sas: prevent heap overflows and unchecked reads
+
+ At two points in handling device ioctls via /dev/mpt2ctl, user-supplied
+ length values are used to copy data from userspace into heap buffers
+ without bounds checking, allowing controllable heap corruption and
+ subsequently privilege escalation.
+
+ Additionally, user-supplied values are used to determine the size of a
+ copy_to_user() as well as the offset into the buffer to be read, with no
+ bounds checking, allowing users to read arbitrary kernel memory.
+
+ Signed-off-by: Dan Rosenberg <drosenberg at vsecurity.com>
+ Cc: stable at kernel.org
+ Acked-by: Eric Moore <eric.moore at lsi.com>
+ Signed-off-by: James Bottomley <James.Bottomley at suse.de>
+ [dannf: backported to Debian's 2.6.32]
+
+diff -urpN linux-source-2.6.32.orig/drivers/scsi/mpt2sas/mpt2sas_ctl.c linux-source-2.6.32/drivers/scsi/mpt2sas/mpt2sas_ctl.c
+--- linux-source-2.6.32.orig/drivers/scsi/mpt2sas/mpt2sas_ctl.c 2009-12-02 20:51:21.000000000 -0700
++++ linux-source-2.6.32/drivers/scsi/mpt2sas/mpt2sas_ctl.c 2011-05-02 23:02:38.163568118 -0600
+@@ -636,6 +636,13 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPT
+ data_out_sz = karg.data_out_size;
+ data_in_sz = karg.data_in_size;
+
++ /* Check for overflow and wraparound */
++ if (karg.data_sge_offset * 4 > ioc->request_sz ||
++ karg.data_sge_offset > (UINT_MAX / 4)) {
++ ret = -EINVAL;
++ goto out;
++ }
++
+ /* copy in request message frame from user */
+ if (copy_from_user(mpi_request, mf, karg.data_sge_offset*4)) {
+ printk(KERN_ERR "failure at %s:%d/%s()!\n", __FILE__, __LINE__,
+@@ -1809,7 +1816,7 @@ _ctl_diag_read_buffer(void __user *arg,
+ Mpi2DiagBufferPostReply_t *mpi_reply;
+ int rc, i;
+ u8 buffer_type;
+- unsigned long timeleft;
++ unsigned long timeleft, request_size, copy_size;
+ u16 smid;
+ u16 ioc_status;
+ u8 issue_reset = 0;
+@@ -1845,6 +1852,8 @@ _ctl_diag_read_buffer(void __user *arg,
+ return -ENOMEM;
+ }
+
++ request_size = ioc->diag_buffer_sz[buffer_type];
++
+ if ((karg.starting_offset % 4) || (karg.bytes_to_read % 4)) {
+ printk(MPT2SAS_ERR_FMT "%s: either the starting_offset "
+ "or bytes_to_read are not 4 byte aligned\n", ioc->name,
+@@ -1852,13 +1861,23 @@ _ctl_diag_read_buffer(void __user *arg,
+ return -EINVAL;
+ }
+
++ if (karg.starting_offset > request_size)
++ return -EINVAL;
++
+ diag_data = (void *)(request_data + karg.starting_offset);
+ dctlprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: diag_buffer(%p), "
+ "offset(%d), sz(%d)\n", ioc->name, __func__,
+ diag_data, karg.starting_offset, karg.bytes_to_read));
+
++ /* Truncate data on requests that are too large */
++ if ((diag_data + karg.bytes_to_read < diag_data) ||
++ (diag_data + karg.bytes_to_read > request_data + request_size))
++ copy_size = request_size - karg.starting_offset;
++ else
++ copy_size = karg.bytes_to_read;
++
+ if (copy_to_user((void __user *)uarg->diagnostic_data,
+- diag_data, karg.bytes_to_read)) {
++ diag_data, copy_size)) {
+ printk(MPT2SAS_ERR_FMT "%s: Unable to write "
+ "mpt_diag_read_buffer_t data @ %p\n", ioc->name,
+ __func__, diag_data);
Modified: dists/squeeze/linux-2.6/debian/patches/series/34
==============================================================================
--- dists/squeeze/linux-2.6/debian/patches/series/34 Tue May 3 05:58:15 2011 (r17287)
+++ dists/squeeze/linux-2.6/debian/patches/series/34 Tue May 3 05:58:24 2011 (r17288)
@@ -42,3 +42,4 @@
- debian/revert-powerpc-kexec-ABI-change-in-2.6.32.34.patch
+ debian/powerpc-kexec-Avoid-ABI-change-in-2.6.32.34.patch
+ bugfix/all/partitions-ldm-fix-oops-caused-by-corrupted-partition-table.patch
++ bugfix/all/mpt2sas-prevent-heap-overflows-and-unchecked-reads.patch
More information about the Kernel-svn-changes
mailing list