https://github.com/torvalds/linux
Revision b500ce8d24d1f14426643da5f6fada28c1f60533 authored by Ahmed S. Darwish on 13 March 2008, 19:32:34 UTC, committed by Linus Torvalds on 13 March 2008, 20:11:43 UTC
Smackfs write() implementation does not put a higher bound on the number of
bytes to copy from user-space.  This may lead to a DOS attack if a malicious
`count' field is given.

Assure that given `count' is exactly the length needed for a /smack/load rule.
 In case of /smack/cipso where the length is relative, assure that `count'
does not exceed the size needed for a buffer representing maximum possible
number of CIPSO 2.2 categories.

Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 93d7446
History
Tip revision: b500ce8d24d1f14426643da5f6fada28c1f60533 authored by Ahmed S. Darwish on 13 March 2008, 19:32:34 UTC
smackfs: do not trust `count' in inodes write()s
Tip revision: b500ce8
File Mode Size
Documentation
arch
block
crypto
drivers
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
usr
virt
.gitignore -rw-r--r-- 644 bytes
.mailmap -rw-r--r-- 3.6 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 90.4 KB
Kbuild -rw-r--r-- 1.6 KB
MAINTAINERS -rw-r--r-- 94.5 KB
Makefile -rw-r--r-- 52.8 KB
README -rw-r--r-- 16.5 KB
REPORTING-BUGS -rw-r--r-- 3.1 KB

README

back to top