Bug 324791 (CVE-2004-2731)

Summary:	CVE-2004-2731 kernel: interger overflows in Sbus PROM driver
Product:	[Other] Security Response	Reporter:	Lubomir Kundrak <lkundrak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	gnichols, jifl-bugzilla, johnp, kernel-maint, kernel-mgr, rt-maint
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2004-2731
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-10-09 12:51:43 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Lubomir Kundrak 2007-10-09 12:26:03 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2004-2731 to the following vulnerability:

Multiple integer overflows in Sbus PROM driver (drivers/sbus/char/openprom.c) for the Linux kernel 2.4.x up to 2.4.27, 2.6.x up to 2.6.7, and possibly later versions, allow local users to execute arbitrary code by specifying (1) a small buffer size to the copyin_string function or (2) a negative buffer size to the copyin function.

References:

http://archives.neohapsis.com/archives/bugtraq/2004-06/0463.html

Comment 2 Lubomir Kundrak 2007-10-09 12:51:43 UTC

Not vulnerable. Linux kernel as shipped with with Red Hat Enterprise Linux 2.1,
3, 4 or 5 did not include the Sbus PROM module and therefore are not affected by
this issue.