Bug 452096 (CVE-2008-2750) - CVE-2008-2750 kernel: l2tp: Fix potential memory corruption in pppol2tp-recvmsg() (Heap corruption DoS)
Summary: CVE-2008-2750 kernel: l2tp: Fix potential memory corruption in pppol2tp-recvm...
Keywords:
Status: CLOSED UPSTREAM
Alias: CVE-2008-2750
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 452110 452111 452112
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-06-19 11:00 UTC by Jan Lieskovsky
Modified: 2021-11-12 19:50 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-12-23 19:07:42 UTC
Embargoed:

Attachments (Terms of Use)

Description Jan Lieskovsky 2008-06-19 11:00:33 UTC 
Description of problem:

James Chapman has provided upstream 2.6.26-rc6 (based on Ilya's report)
for the following issue:

This patch fixes a potential memory corruption in
pppol2tp_recvmsg(). If skb->len is bigger than the caller's buffer
length, memcpy_toiovec() will go into unintialized data on the kernel
heap, interpret it as an iovec and start modifying memory.

The fix is to change the memcpy_toiovec() call to
skb_copy_datagram_iovec() so that paged packets (rare for PPPOL2TP)
are handled properly. Also check that the caller's buffer is big
enough for the data and set the MSG_TRUNC flag if it is not so.

Version-Release number of selected component (if applicable):
All kernel versions containing support for L2TP protocol < 2.6.26-rc6


Additional info:

Proposed upstream patch for this issue from James Chapman:

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=6b6707a50c7598a83820077393f8823ab791abf8;hp=2e761e0532a784816e7e822dbaaece8c5d4be14d
Note You need to log in before you can comment on or make changes to this bug.