Bug 127256 - CAN-2004-0619 Broadcom 5820 integer overflow
CAN-2004-0619 Broadcom 5820 integer overflow
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 2.1
Classification: Red Hat
Component: kernel (Show other bugs)
2.1
i386 Linux
medium Severity medium
: ---
: ---
Assigned To: Nalin Dahyabhai
Brian Brock
http://marc.theaimsgroup.com/?l=bugtr...
impact=moderate,public=20040623
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2004-07-05 06:58 EDT by Mark J. Cox (Product Security)
Modified: 2007-11-30 17:06 EST (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2005-04-28 11:05:10 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
bcm5820-update-rhel21.patch (418.68 KB, patch)
2004-12-15 12:15 EST, John W. Linville
no flags Details | Diff

  None (edit)
Description Mark J. Cox (Product Security) 2004-07-05 06:58:03 EDT
Reported to Bugtraq on Jun23.  

An integer overflow in the ubsec_keysetup function for Linux Broadcom
5820 cryptonet driver allows local users to cause a denial of service
(crash) and possibly execute arbitrary code via a negative
add_dsa_buf_bytes variable, which leads to a buffer overflow.

See also http://secunia.com/advisories/11936/
Comment 1 Jim Paradis 2004-11-29 16:28:47 EST
See also Bug 127258
Comment 2 John W. Linville 2004-12-15 12:15:34 EST
Created attachment 108634 [details]
bcm5820-update-rhel21.patch

Patch brings RHEL2.1 BCM5820 driver in sync with version in RHEL3.
Comment 3 John W. Linville 2004-12-15 12:40:29 EST
Unfortunately, above patch does not appear to actually work... :-(
Comment 4 John W. Linville 2004-12-20 11:02:01 EST
Well, I seem to have spoken too soon...the above patch DOES work,
provided that the "bcm5820" package is replaced with the later
"hwcrypto" package.

I'm going to propose the above patch on the proviso that the RHEL2.1
update includes the "hwcrypto" package rather than the "bcm5820"
package (or an updated "bcm5820" package that takes the bcm5820
portions of the "hwcrypto" package).
Comment 14 John Flanagan 2005-04-28 11:05:10 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2005-283.html

Note You need to log in before you can comment on or make changes to this bug.