From Daniel Roethlisberger wrote

While using the Linux drivers for the CM4040 as a reference for writing a cmx
FreeBSD driver I found two buffer overflows in the Linux drivers, one in the
write() and one in the read() handler.  

When calling write() with a buffer larger than 512 bytes, the driver's write
buffer overflows, allowing to overwrite the EIP and execute arbitrary code with
kernel privileges.  

In read(), we have a similar problem, but coming from the device. A malicous or
buggy device sending more than 512 bytes can overflow of the driver's read
buffer, with the same effects as above.

The write() vulnerability can only be exploited by a user with direct or
indirect write access to the cmx device special file. Normally, this is limited
to root, so this is not an issue. However, it might be possible for unprivileged
users to cause large writes indirectly via userland daemons such as those
provided by pcsc-lite or openct. Since "normal" APDU payloads are smaller than
512 bytes, this may not be an issue, but I haven't looked into that.
Furthermore, a system can be set up to allow access to the device for a special
user or group, in order to increase security by running the userland drivers
without root privileges. In such a setup, users with access to the device can
elevate privileges or cause DoS.

The problem code in cm4040_cs.c:cm4040_write() is on line 358 (current version
in Linus' git tree), when calling copy_from_user() with user supplied
bytes_to_write, which can be larger than 512 bytes. Because it does not seem to
make sense to write partial messages to this card reader, I think it is best to
return an appropriate error on write()'s larger than the write buffer. This is
what I do in the FreeBSD driver.

The problem code in cm4040_cs.c:cm4040_read() is around line 271 where
bytes_to_read is read from the card reader, and subsequently, min(count,
bytes_to_read + 5) bytes are read from the reader. min(count, bytes_to_read + 5)
can however be larger than the read buffer, which would cause an overflow.

The embargo ended on 6th of March.

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2007-0099.html