Bug 281999 (CVE-2009-2846)

Summary:	Kernel: parisc isa-eeprom eisa_eeprom_read() memory disclosure (CVE-2009-2846)
Product:	Gentoo Security	Reporter:	Alex Legler (RETIRED) <a3li>
Component:	Kernel	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	blueness, hardened, kernel
Priority:	High
Version:	unspecified
Hardware:	HPPA
OS:	Linux
URL:	http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=6b4dbcd86a9d464057fcc7abe4d0574093071fcc
Whiteboard:	[ linux < 2.6.31 ]
Package list:		Runtime testing required:	---
Bug Depends on:	305733, 307847
Bug Blocks:

Description Alex Legler (RETIRED) archtester

2009-08-19 09:20:30 UTC

CVE-2009-2846 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2846):
  The eisa_eeprom_read function in the parisc isa-eeprom component
  (drivers/parisc/eisa_eeprom.c) in the Linux kernel before 2.6.31-rc6
  allows local users to access restricted memory via a negative ppos
  argument, which bypasses a check that assumes that ppos is positive
  and causes an out-of-bounds read in the readb function.

Comment 1 Jeroen Roovers (RETIRED) gentoo-dev

2010-04-17 15:26:55 UTC

I believe the bug is fixed in the more recently stable kernels.

Comment 2 Guy Martin (RETIRED) gentoo-dev

2010-08-02 18:50:38 UTC

vanilla-sources 2.6.32.9 stable from some time already.

Shall I close ?

Comment 3 Agostino Sarubbo gentoo-dev

2013-01-14 15:14:02 UTC

The work for hppa is done. CC back if security needs something.

Comment 4 Aaron Bauman (RETIRED) gentoo-dev

2016-11-29 23:47:41 UTC

No vulnerable sources left in tree.