Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 157836 - Kernel: Multiple problems in net/bluetooth/cmtp/capi.c (CVE-2006-6106)
Summary: Kernel: Multiple problems in net/bluetooth/cmtp/capi.c (CVE-2006-6106)
Status: RESOLVED DUPLICATE of bug 158791
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Kernel (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
URL: http://git.kernel.org/?p=linux/kernel...
Whiteboard: [linux <2.6.16.38] [linux >=2.6.17 <2...
Keywords:
Depends on:
Blocks:
 
Reported: 2006-12-11 08:07 UTC by Sune Kloppenborg Jeppesen (RETIRED)
Modified: 2009-07-13 19:02 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---

Attachments
patch-bluetooth-cmtp-length-checks (patch-bluetooth-cmtp-length-checks,3.63 KB, patch)
2006-12-11 08:08 UTC, Sune Kloppenborg Jeppesen (RETIRED) 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2006-12-11 08:07:44 UTC 
Handling of incoming packet in net/bluetooth/cmtp/capi.c:

     case CAPI_FUNCTION_GET_SERIAL_NUMBER:
             controller = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 12);
             if (!info && ctrl) {
                     memset(ctrl->serial, 0, CAPI_SERIAL_LEN);
                     strncpy(ctrl->serial,
                             skb->data + CAPI_MSG_BASELEN + 17,
                             skb->data[CAPI_MSG_BASELEN + 16]);
             }
             break;

The "->serial" is "unsigned char[8]" and no checks are done on 
"skb->data[CAPI_MSG_BASELEN + 16]" incoming packet.

This could mess with "struct capi_ctr" from include/linux/isdn/capilli.h 
and give a posibility to overwrite "struct proc_dir_entry *procent;".

The "case CAPI_FUNCTION_GET_MANUFACTURER:" in the same place is dealing 
with same problem.
Comment 1 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2006-12-11 08:08:30 UTC 
Created attachment 103801 [details, diff]
patch-bluetooth-cmtp-length-checks
Comment 2 Harlan Lieberman-Berg (RETIRED) gentoo-dev 2007-05-21 23:39:48 UTC 
Xen, this is you only. Past release date, so CC'ing herd isn't unacceptable.

Bump to 2.6.18.6 or 2.6.19.x, or patch.
Comment 3 Micheal Marineau (RETIRED) gentoo-dev 2007-08-26 23:33:09 UTC 
(In reply to comment #2)
> Xen, this is you only. Past release date, so CC'ing herd isn't unacceptable.
> 
> Bump to 2.6.18.6 or 2.6.19.x, or patch.
> 

Fixed in xen-sources-2.6.18-r3
Comment 5 Bjoern Tropf (RETIRED) gentoo-dev 2009-07-13 19:00:58 UTC 
Duplicate:
(CVE-2006-6106) http://bugs.gentoo.org/show_bug.cgi?id=158791
Comment 6 Bjoern Tropf (RETIRED) gentoo-dev 2009-07-13 19:02:01 UTC 

*** This bug has been marked as a duplicate of bug 158791 ***