| Summary: | Kernel: Multiple problems in net/bluetooth/cmtp/capi.c (CVE-2006-6106) | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Sune Kloppenborg Jeppesen (RETIRED) <jaervosz> | ||||
| Component: | Kernel | Assignee: | Gentoo Security <security> | ||||
| Status: | RESOLVED DUPLICATE | ||||||
| Severity: | normal | ||||||
| Priority: | High | ||||||
| Version: | unspecified | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| URL: | http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.19.y.git;a=commit;h=d4ea7f9f5554d94dcb8a630f470c724d05e8f112 | ||||||
| Whiteboard: | [linux <2.6.16.38] [linux >=2.6.17 <2.6.18.6] [linux >=2.6.19 <2.6.19.2] | ||||||
| Package list: | Runtime testing required: | --- | |||||
| Attachments: |
|
||||||
Created attachment 103801 [details, diff]
patch-bluetooth-cmtp-length-checks
Xen, this is you only. Past release date, so CC'ing herd isn't unacceptable. Bump to 2.6.18.6 or 2.6.19.x, or patch. (In reply to comment #2) > Xen, this is you only. Past release date, so CC'ing herd isn't unacceptable. > > Bump to 2.6.18.6 or 2.6.19.x, or patch. > Fixed in xen-sources-2.6.18-r3 http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.16.y.git;a=commit;h=044a3e96c42df125bbc046495d49a6b8f380aa5a http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.18.y.git;a=commit;h=1dca7c280661c5741ac2eeb4b5386c1a566bf0b1 http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.19.y.git;a=commit;h=d4ea7f9f5554d94dcb8a630f470c724d05e8f112 Duplicate: (CVE-2006-6106) http://bugs.gentoo.org/show_bug.cgi?id=158791 *** This bug has been marked as a duplicate of bug 158791 *** |
Handling of incoming packet in net/bluetooth/cmtp/capi.c: case CAPI_FUNCTION_GET_SERIAL_NUMBER: controller = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 12); if (!info && ctrl) { memset(ctrl->serial, 0, CAPI_SERIAL_LEN); strncpy(ctrl->serial, skb->data + CAPI_MSG_BASELEN + 17, skb->data[CAPI_MSG_BASELEN + 16]); } break; The "->serial" is "unsigned char[8]" and no checks are done on "skb->data[CAPI_MSG_BASELEN + 16]" incoming packet. This could mess with "struct capi_ctr" from include/linux/isdn/capilli.h and give a posibility to overwrite "struct proc_dir_entry *procent;". The "case CAPI_FUNCTION_GET_MANUFACTURER:" in the same place is dealing with same problem.