Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 158782 - Linux 2.6.x ISO9660 __find_get_block_slow() denial of service (CVE-2006-5757)
Summary: Linux 2.6.x ISO9660 __find_get_block_slow() denial of service (CVE-2006-5757)
Status: RESOLVED DUPLICATE of bug 155769
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Kernel (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
URL: http://projects.info-pull.com/mokb/MO...
Whiteboard: [2.6 < 2.6.19]
Keywords:
: 158789 (view as bug list)
Depends on:
Blocks:
 
Reported: 2006-12-21 18:39 UTC by Daniel Drake (RETIRED)
Modified: 2007-01-01 20:19 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---

Attachments
patch (1905_fs-buffers-infinite-loop.patch,1.92 KB, patch)
2006-12-23 08:23 UTC, Daniel Drake (RETIRED) 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Daniel Drake (RETIRED) gentoo-dev 2006-12-21 18:39:41 UTC 
The ISO9660 filesystem handling code of the Linux 2.6.x kernel fails to properly handle corrupted data structures, leading to an exploitable denial of service condition. This particular vulnerability seems to be caused by a race condition and a signedness issue. When performing a read operation on a corrupted ISO9660 fs stream, the isofs_get_blocks() function will enter an infinite loop when __find_get_block_slow() callback from sb_getblk() fails ("due to various races between file io on the block device and getblk").
Comment 1 Daniel Drake (RETIRED) gentoo-dev 2006-12-23 08:23:33 UTC 
Created attachment 104638 [details, diff]
patch
Comment 2 Daniel Drake (RETIRED) gentoo-dev 2006-12-26 05:05:07 UTC 
*** Bug 158789 has been marked as a duplicate of this bug. ***
Comment 3 Daniel Drake (RETIRED) gentoo-dev 2006-12-26 12:20:30 UTC 
Fixed in genpatches-2.6.18-8 (gentoo-sources-2.6.18-r6)
Comment 4 Daniel Drake (RETIRED) gentoo-dev 2007-01-01 20:19:21 UTC 

*** This bug has been marked as a duplicate of 155769 ***