From: Alan Cox <alan@lxorguk.ukuu.org.uk>
To: engler@csl.Stanford.EDU (Dawson Engler)
Cc: linux-kernel@vger.kernel.org, mc@cs.Stanford.EDU
Subject: Re: [CHECKER] 2.4.5-ac4 security holes
Date: Fri, 1 Jun 2001 08:42:20 +0100 (BST) [thread overview]
Message-ID: <E155jZc-00009b-00@the-village.bc.nu> (raw)
In-Reply-To: <200106010449.VAA17373@csl.Stanford.EDU> from "Dawson Engler" at May 31, 2001 09:49:14 PM
> [BUG] looks really broken.
> /u2/engler/mc/oses/linux/2.4.5-ac4/fs/ioctl.c:108:sys_ioctl: ERROR:PARAM:70:108: Deref tainted var 'arg' (tainted from line 70)
Been meaning to dump that anyway so that was solved by the delete approach
- real bug
> [BUG] sure seems like it. In general, all 4 dereferences seem pretty bad.
> /u2/engler/mc/oses/linux/2.4.5-ac4/drivers/net/wan/cosa.c:1049:cosa_download: ERROR:PARAM:1046:1049: Deref tainted var 'd' (tainted from line 1046)
> return -EPERM;
Fixed .. only available to root anyway
> /u2/engler/mc/oses/linux/2.4.5-ac4/drivers/net/wan/cosa.c:1057:cosa_download: ERROR:PARAM:1046:1057: Deref tainted var 'd' (tainted from line 1046)
> return -EPERM;
> }
>
Ditto
> switch (cmd) {
> case SNDCTL_SYNTH_INFO:
> memcpy (&((char *) arg)[0], &wavefront_info,
Fixed
> [BUG] [RESURRECTED] Should be fixed in ac5, though.
> /u2/engler/mc/oses/linux/2.4.5-ac4/drivers/isdn/eicon/linchr.c:128:do_ioctl: ERROR:PARAM:60:128: tainted var 'arg' (from line 60) used as arg 0 to 'DivasGetList'
Done (wasnt fixed in ac5)
prev parent reply other threads:[~2001-06-01 7:45 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2001-06-01 4:49 Dawson Engler
2001-06-01 5:16 ` Greg KH
2001-06-01 7:42 ` Alan Cox [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=E155jZc-00009b-00@the-village.bc.nu \
--to=alan@lxorguk.ukuu.org.uk \
--cc=engler@csl.Stanford.EDU \
--cc=linux-kernel@vger.kernel.org \
--cc=mc@cs.Stanford.EDU \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®