Linux Kernel irda_bind () object clearing Null Pointer Reference Vulnerability

Linux Kernel irda_bind () object clearing Null Pointer Reference Vulnerability

Released on: 2010-09-01
Updated on: 2010-09-02

Affected Systems:
Linux kernel 2.6.x
Description:
--------------------------------------------------------------------------------
Bugtraq id: 42900
CVE (CAN) ID: CVE-2010-2954

Linux Kernel is the Kernel used by open source Linux.

The irda_bind () function in the net/irda/af_irda.c file of Linux Kernel has an error when trying to release some objects. Local Users can try to bind the AF_IRDA socket and trigger an error to cause NULL pointer reference.

If irda_open_tsap () fails, irda_bind () is released incorrectly-> ias_obj object. Specifically, hashbin attached to the object is not released and the self-> ias_obj pointer is reset to NULL.

<* Source: Tavis Ormandy (taviso@gentoo.org)

Link: http://secunia.com/advisories/41234/
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Linux
-----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://git.kernel.org /? P = linux/kernel/git/davem/net-2.6.git; a = commitdiff; h = 628e300cccaa628d8fb92aa28cb7530a3d5f2257