Red Hat Bugzilla – Bug 632069
CVE-2010-3084 kernel: niu: buffer overflow for ETHTOOL_GRXCLSRLALL
Last modified: 2012-07-17 20:32:17 EDT
Description of problem:
niu_get_ethtool_tcam_all() assumes that its output buffer is the right size, and warns before returning if it is not. However, the output buffer size is under user control and ETHTOOL_GRXCLSRLALL is an unprivileged ethtool command. Therefore this is at least a local denial-of-service vulnerability.
Change it to check before writing each entry and to return an error if the buffer is already full.
This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 3 and 4, as they do not include support for the Neptune Ethernet driver. It did not affect Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG, as they do not contain the upstream commit 2d96cf8c that introduced this flaw.
This is commit ee9c5cfad29c8a13199962614b9b16f1c4137ac9
This issue has been addressed in following products:
Red Hat Enterprise Linux 6
Via RHSA-2010:0842 https://rhn.redhat.com/errata/RHSA-2010-0842.html