Bug 681259 (CVE-2011-1078)

Summary: CVE-2011-1078 kernel: bt sco_conninfo infoleak
Product: [Other] Security Response Reporter: Petr Matousek <pmatouse>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: arozansk, bhu, dhoward, jkacur, jlieskov, kernel-mgr, kmcmartin, lgoncalv, lwang, rkhan, rt-maint, tcallawa, vgoyal, vkrizan, williams
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-07-29 14:06:44 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 681307, 681308, 681309, 681310, 681311, 681312    
Bug Blocks:    

Description Petr Matousek 2011-03-01 15:27:35 UTC 
Description of problem:
struct sco_conninfo has one padding byte in the end.  Local variable
cinfo of type sco_conninfo is copied to userspace with this uninizialized
one byte, leading to old stack contents leak.

Reference:
http://seclists.org/oss-sec/2011/q1/309
https://lkml.org/lkml/2011/2/14/49

Acknowledgements:

Red Hat would like to thank Vasiliy Kulikov of Openwall for reporting this issue.
Comment 5 Eugene Teo (Security Response) 2011-04-11 04:05:38 UTC 
Upstream commit:
http://git.kernel.org/linus/c4c896e1471aec3b004a693c689f60be3b17ac86
Comment 6 errata-xmlrpc 2011-05-10 17:20:37 UTC 
This issue has been addressed in following products:

  MRG for RHEL-5

Via RHSA-2011:0500 https://rhn.redhat.com/errata/RHSA-2011-0500.html
Comment 7 errata-xmlrpc 2011-05-31 14:06:24 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2011:0833 https://rhn.redhat.com/errata/RHSA-2011-0833.html
Comment 8 errata-xmlrpc 2012-08-14 18:09:07 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:1156 https://rhn.redhat.com/errata/RHSA-2012-1156.html