Linux Kernel gdth Kernel Memory Corruption Vulnerability

Linux Kernel gdth Kernel Memory Corruption Vulnerability

Release date:
Updated on:

Affected Systems:
Linux kernel 2.6.x
Description:
--------------------------------------------------------------------------------
Cve id: CVE-2010-4157

Linux Kernel is the Kernel used by open source Linux.

The value variable of the gdth_ioctl_alloc () function of Linux Kernel is int type, while the size variable of the copy_from_user () function is not long. Gen. data_len and gen. sense_len are non-long characters. On x86_64 systems, the long type is 64-bit, And the int type is 32-bit. If the user transfers an extra-long value, the allocation will be truncated to 32 bits, allocated a buffer that is too small, and then may cause memory corruption when copy_from_user () is executed.

<* Source: Dan Carpenter (error27@gmail.com)

Link: http://secunia.com/advisories/42035/

*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Linux
-----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://git.kernel.org /? P = linux/kernel/git/torvalds/linux-2.6.git; a = commitdiff; h = f63ae56e4e97fb12053590e41a4fa59e7daa74a4