Linux Kernel IEEE 1394 Integer Overflow Vulnerability
BID:10593
Info
Linux Kernel IEEE 1394 Integer Overflow Vulnerability
| Bugtraq ID: | 10593 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2004-0658 |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 22 2004 12:00AM |
| Updated: | Jul 12 2009 05:16AM |
| Credit: | [email protected] disclosed this vulnerability to Bugtraq. |
| Vulnerable: |
Linux kernel 2.6.7 rc1 Linux kernel 2.6.7 Linux kernel 2.6.6 rc1 Linux kernel 2.6.6 Linux kernel 2.6.5 Linux kernel 2.6.4 Linux kernel 2.6.3 Linux kernel 2.6.2 Linux kernel 2.6.1 -rc2 Linux kernel 2.6.1 -rc1 Linux kernel 2.6.1 Linux kernel 2.6 -test9-CVS Linux kernel 2.6 -test9 Linux kernel 2.6 -test8 Linux kernel 2.6 -test7 Linux kernel 2.6 -test6 Linux kernel 2.6 -test5 Linux kernel 2.6 -test4 Linux kernel 2.6 -test3 Linux kernel 2.6 -test2 Linux kernel 2.6 -test11 Linux kernel 2.6 -test10 Linux kernel 2.6 -test1 Linux kernel 2.6 Linux kernel 2.5.69 Linux kernel 2.5.68 Linux kernel 2.5.67 Linux kernel 2.5.66 Linux kernel 2.5.65 Linux kernel 2.5.64 Linux kernel 2.5.63 Linux kernel 2.5.62 Linux kernel 2.5.61 Linux kernel 2.5.60 Linux kernel 2.5.59 Linux kernel 2.5.58 Linux kernel 2.5.57 Linux kernel 2.5.56 Linux kernel 2.5.55 Linux kernel 2.5.54 Linux kernel 2.5.53 Linux kernel 2.5.52 Linux kernel 2.5.51 Linux kernel 2.5.50 Linux kernel 2.5.49 Linux kernel 2.5.48 Linux kernel 2.5.47 Linux kernel 2.5.46 Linux kernel 2.5.45 Linux kernel 2.5.44 Linux kernel 2.5.43 Linux kernel 2.5.42 Linux kernel 2.5.41 Linux kernel 2.5.40 Linux kernel 2.5.39 Linux kernel 2.5.38 Linux kernel 2.5.37 Linux kernel 2.5.36 Linux kernel 2.5.35 Linux kernel 2.5.34 Linux kernel 2.5.33 Linux kernel 2.5.32 Linux kernel 2.5.31 Linux kernel 2.5.30 Linux kernel 2.5.29 Linux kernel 2.5.28 Linux kernel 2.5.27 Linux kernel 2.5.26 Linux kernel 2.5.25 Linux kernel 2.5.24 Linux kernel 2.5.23 Linux kernel 2.5.22 Linux kernel 2.5.21 Linux kernel 2.5.20 Linux kernel 2.5.19 Linux kernel 2.5.18 Linux kernel 2.5.17 Linux kernel 2.5.16 Linux kernel 2.5.15 Linux kernel 2.5.14 Linux kernel 2.5.13 Linux kernel 2.5.12 Linux kernel 2.5.11 Linux kernel 2.5.10 Linux kernel 2.5.9 Linux kernel 2.5.8 Linux kernel 2.5.7 Linux kernel 2.5.6 Linux kernel 2.5.5 Linux kernel 2.5.4 Linux kernel 2.5.3 Linux kernel 2.5.2 Linux kernel 2.5.1 Linux kernel 2.5 .0 Linux kernel 2.4.27 -pre2 Linux kernel 2.4.27 -pre1 Linux kernel 2.4.26 Linux kernel 2.4.25 Linux kernel 2.4.24 -ow1 Linux kernel 2.4.24 Linux kernel 2.4.23 -pre9 Linux kernel 2.4.23 -ow2 Linux kernel 2.4.23 Linux kernel 2.4.22 Linux kernel 2.4.21 pre7 Linux kernel 2.4.21 pre4 Linux kernel 2.4.21 pre1 Linux kernel 2.4.21 Linux kernel 2.4.20 Linux kernel 2.4.19 -pre6 Linux kernel 2.4.19 -pre5 Linux kernel 2.4.19 -pre4 Linux kernel 2.4.19 -pre3 Linux kernel 2.4.19 -pre2 Linux kernel 2.4.19 -pre1 Linux kernel 2.4.19 Linux kernel 2.4.18 pre-8 Linux kernel 2.4.18 pre-7 Linux kernel 2.4.18 pre-6 Linux kernel 2.4.18 pre-5 Linux kernel 2.4.18 pre-4 Linux kernel 2.4.18 pre-3 Linux kernel 2.4.18 pre-2 Linux kernel 2.4.18 pre-1 Linux kernel 2.4.18 x86 Linux kernel 2.4.18 Linux kernel 2.4.17 Linux kernel 2.4.16 Linux kernel 2.4.15 Linux kernel 2.4.14 Linux kernel 2.4.13 Linux kernel 2.4.12 Linux kernel 2.4.11 Linux kernel 2.4.10 Linux kernel 2.4.9 Linux kernel 2.4.8 Linux kernel 2.4.7 Linux kernel 2.4.6 Linux kernel 2.4.5 Linux kernel 2.4.4 Linux kernel 2.4.3 Linux kernel 2.4.2 Linux kernel 2.4.1 Linux kernel 2.4 .0-test9 Linux kernel 2.4 .0-test8 Linux kernel 2.4 .0-test7 Linux kernel 2.4 .0-test6 Linux kernel 2.4 .0-test5 Linux kernel 2.4 .0-test4 Linux kernel 2.4 .0-test3 Linux kernel 2.4 .0-test2 Linux kernel 2.4 .0-test12 Linux kernel 2.4 .0-test11 Linux kernel 2.4 .0-test10 Linux kernel 2.4 .0-test1 Linux kernel 2.4 |
| Not Vulnerable: | |
Discussion
Linux Kernel IEEE 1394 Integer Overflow Vulnerability
The driver for IEEE 1394 in the Linux kernel is reported to contain an integer overflow vulnerability.
The driver contains a function called alloc_hpsb_packet(). This function takes an unsigned integer argument and uses it to allocate kernel memory. When allocating memory, the value is incremented, potentially overflowing the integer.
There are multiple code paths leading to the vulnerable alloc_hpsb_packet() function, with multiple possible methods of exploiting this vulnerability.
Successful exploitation could lead to system crash, or possible code execution.
The driver for IEEE 1394 in the Linux kernel is reported to contain an integer overflow vulnerability.
The driver contains a function called alloc_hpsb_packet(). This function takes an unsigned integer argument and uses it to allocate kernel memory. When allocating memory, the value is incremented, potentially overflowing the integer.
There are multiple code paths leading to the vulnerable alloc_hpsb_packet() function, with multiple possible methods of exploiting this vulnerability.
Successful exploitation could lead to system crash, or possible code execution.
Exploit / POC
Linux Kernel IEEE 1394 Integer Overflow Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Linux Kernel IEEE 1394 Integer Overflow Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Linux Kernel IEEE 1394 Integer Overflow Vulnerability
References:
References: