Reported to Bugtraq on Jun23.
An integer overflow in the ubsec_keysetup function for Linux Broadcom
5820 cryptonet driver allows local users to cause a denial of service
(crash) and possibly execute arbitrary code via a negative
add_dsa_buf_bytes variable, which leads to a buffer overflow.
See also http://secunia.com/advisories/11936/
See also Bug 127258
Created attachment 108634 [details]
Patch brings RHEL2.1 BCM5820 driver in sync with version in RHEL3.
Unfortunately, above patch does not appear to actually work... :-(
Well, I seem to have spoken too soon...the above patch DOES work,
provided that the "bcm5820" package is replaced with the later
I'm going to propose the above patch on the proviso that the RHEL2.1
update includes the "hwcrypto" package rather than the "bcm5820"
package (or an updated "bcm5820" package that takes the bcm5820
portions of the "hwcrypto" package).
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.