Bug 127256 – CAN-2004-0619 Broadcom 5820 integer overflow

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 127256 - CAN-2004-0619 Broadcom 5820 integer overflow

Summary:	CAN-2004-0619 Broadcom 5820 integer overflow

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 2.1
Classification:	Red Hat
Component:	kernel (Show other bugs)
Sub Component:
Version:	2.1
Hardware:	i386 Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Nalin Dahyabhai
QA Contact:	Brian Brock
Docs Contact:

URL:	http://marc.theaimsgroup.com/?l=bugtr...
Whiteboard:	impact=moderate,public=20040623
Keywords:	Security

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2004-07-05 06:58 EDT by Mark J. Cox
Modified:	2007-11-30 17:06 EST (History)
CC List:	7 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2005-04-28 11:05:10 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
bcm5820-update-rhel21.patch (418.68 KB, patch) 2004-12-15 12:15 EST, John W. Linville	no flags	Details \| Diff
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2005:283	high	SHIPPED_LIVE	Important: kernel security update	2005-04-28 00:00:00 EDT

Groups: None (edit)

Description Mark J. Cox 2004-07-05 06:58:03 EDT

Reported to Bugtraq on Jun23.  

An integer overflow in the ubsec_keysetup function for Linux Broadcom
5820 cryptonet driver allows local users to cause a denial of service
(crash) and possibly execute arbitrary code via a negative
add_dsa_buf_bytes variable, which leads to a buffer overflow.

See also http://secunia.com/advisories/11936/

Comment 1 Jim Paradis 2004-11-29 16:28:47 EST

See also Bug 127258

Comment 2 John W. Linville 2004-12-15 12:15:34 EST

Created attachment 108634 [details]
bcm5820-update-rhel21.patch

Patch brings RHEL2.1 BCM5820 driver in sync with version in RHEL3.

Comment 3 John W. Linville 2004-12-15 12:40:29 EST

Unfortunately, above patch does not appear to actually work... :-(

Comment 4 John W. Linville 2004-12-20 11:02:01 EST

Well, I seem to have spoken too soon...the above patch DOES work,
provided that the "bcm5820" package is replaced with the later
"hwcrypto" package.

I'm going to propose the above patch on the proviso that the RHEL2.1
update includes the "hwcrypto" package rather than the "bcm5820"
package (or an updated "bcm5820" package that takes the bcm5820
portions of the "hwcrypto" package).

Comment 14 John Flanagan 2005-04-28 11:05:10 EDT

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2005-283.html

Note You need to log in before you can comment on or make changes to this bug.