Bug 392101 (CVE-2007-6063) - CVE-2007-6063 Linux Kernel isdn_net_setcfg buffer overflow
Summary: CVE-2007-6063 Linux Kernel isdn_net_setcfg buffer overflow
Status: CLOSED ERRATA
Alias: CVE-2007-6063
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All
OS: Linux
low
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,reported=20071120,sou...
Keywords: Security
Depends On: 392111 392121 392131 392151 392161 456360 456361
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-11-20 12:50 UTC by Jan Lieskovsky
Modified: 2011-09-29 21:27 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2011-09-29 21:27:13 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Proposed backported patch for RHEL-3.9 (1.77 KB, patch)
2008-07-23 05:22 UTC, Eugene Teo (Security Response)
no flags Details | Diff
Proposed backported patch for RHEL-2.1 (1.78 KB, patch)
2008-07-23 05:46 UTC, Eugene Teo (Security Response)
no flags Details | Diff


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2008:0055 normal SHIPPED_LIVE Important: kernel security and bug fix update 2008-01-31 18:35:49 UTC
Red Hat Product Errata RHSA-2008:0154 normal SHIPPED_LIVE Important: kernel security and bug fix update 2008-03-05 13:58:42 UTC
Red Hat Product Errata RHSA-2008:0787 normal SHIPPED_LIVE Important: kernel security update 2009-01-05 07:08:54 UTC
Red Hat Product Errata RHSA-2008:0973 normal SHIPPED_LIVE Important: kernel security and bug fix update 2008-12-17 03:18:50 UTC
Red Hat Product Errata RHSA-2009:0001 normal SHIPPED_LIVE Important: kernel security update 2009-01-08 15:47:52 UTC

Description Jan Lieskovsky 2007-11-20 12:50:18 UTC
Description of problem:

The Linux kernel is prone to an buffer overflow vulnerability. This
issue is due to a design error in the 'isdn_net_setcfg()' function.
There is a buffer overflow vulnerability in function isdn_net_setcfg().

At line 1413, in drivers/isdn/i4l/isdn_common.c the 'cfg' is read from
user-space. so the 'cfg' is user-controlled. At line 1415, function
isdn_net_setcfg() is invoked. The '&cfg' is passed to isdn_net_setcfg()
as an argument.

At line 2805 in drivers/isdn/il4/isdn_net.c, function strcpy() is invoked. The
size of argument lp->msn is 32 and cfg->eaz is 256. Because the data of '*cfg'
is user-controlled (so cfg->eaz is user-controlled), it's possible to overrun 
destination string lp->msn by string cfg->eaz. When the length of string
'cfg->eaz' is greater than 32, a buffer overflow will occur.

This issue is public via:

http://bugzilla.kernel.org/show_bug.cgi?id=9416

Comment 11 Eugene Teo (Security Response) 2008-07-23 05:22:09 UTC
Created attachment 312419 [details]
Proposed backported patch for RHEL-3.9

Comment 12 Eugene Teo (Security Response) 2008-07-23 05:46:18 UTC
Created attachment 312420 [details]
Proposed backported patch for RHEL-2.1


Note You need to log in before you can comment on or make changes to this bug.