| Summary: | Kernel : AACRAID Driver compat IOCTL missing capability check | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Kernel | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED DUPLICATE | ||
| Severity: | normal | CC: | kernel |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://bugzilla.redhat.com/show_bug.cgi?id=1033530 | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
*** This bug has been marked as a duplicate of bug 490420 *** |
From ${URL} : Linux kernel built with the Adaptec RAID controller support(CONFIG_SCSI_AACRAID) along with the compat mode(CONFIG_COMPAT), is vulnerable due to a missing capability check in a compat ioctl routine. This could lead to undue usage of restricted operations by users. A user/program could use this flaw to perform protected operations via compat ioctl route. Upstream fix: ------------- -> https://git.kernel.org/linus/f856567b930dfcdbc3323261bf77240ccdde01f5 Reference: ---------- -> https://secunia.com/advisories/55562/