linux kernel 2.6.33.7 integer overflow in ext4_ext_get_blocks()

2010.08.24

Credit: Eugene Teo

Risk: Low

Local: Yes

Remote: No

CVE: CVE-2010-3015

CWE: CWE-189

Ogólna skala CVSS: 4.7/10

Znaczenie: 6.9/10

Łatwość wykorzystania: 3.4/10

Wymagany dostęp: Lokalny

Złożoność ataku: Średnia

Autoryzacja: Nie wymagana

Wpływ na poufność: Brak

Wpływ na integralność: Brak

Wpływ na dostępność: Pełny

This was reported by a customer. Integer overflow flaws were found in
ext4_ext_in_cache() and ext4_ext_get_blocks(). We managed to triggered
the case in ext4_ext_get_blocks() but did not attempt to try the other.
This can trigger a BUG() on certain configuration of ext4 file systems.
Upstream commit:
http://git.kernel.org/linus/731eb1a03a8445cde2cb23ecfb3580c6fa7bb690
https://bugzilla.redhat.com/show_bug.cgi?id=624327
Thanks, Eugene

Referencje:

http://marc.info/?l=oss-security&m=128197862004376&w=2

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=731eb1a03a8445cde2cb23ecfb3580c6fa7bb690

https://bugzilla.redhat.com/show_bug.cgi?id=624327

http://xforce.iss.net/xforce/xfdb/61156

http://www.securityfocus.com/bid/42477

http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.34

http://marc.info/?l=oss-security&m=128201627016896&w=2

http://marc.info/?l=oss-security&m=128192548904503&w=2

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

linux kernel 2.6.33.7 integer overflow in ext4_ext_get_blocks()

Referencje:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.