Linux Kernel d_path() Path Truncation Vulnerability
BID:4367
Info
Linux Kernel d_path() Path Truncation Vulnerability
| Bugtraq ID: | 4367 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2002-0499 |
| Remote: | No |
| Local: | Yes |
| Published: | Mar 26 2002 12:00AM |
| Updated: | Jul 11 2009 11:56AM |
| Credit: | Discovered by Wojciech Purczynski <[email protected]>. |
| Vulnerable: |
Linux kernel 2.4.19 Linux kernel 2.4.18 Linux kernel 2.4.17 Linux kernel 2.4.16 Linux kernel 2.4.15 Linux kernel 2.4.14 Linux kernel 2.4.13 Linux kernel 2.4.12 Linux kernel 2.4.11 Linux kernel 2.4.10 Linux kernel 2.4.9 Linux kernel 2.4.8 Linux kernel 2.4.7 Linux kernel 2.4.6 Linux kernel 2.4.5 Linux kernel 2.4.4 Linux kernel 2.4.3 Linux kernel 2.4.2 Linux kernel 2.4.1 Linux kernel 2.4 Linux kernel 2.3.99 Linux kernel 2.3 Linux kernel 2.2.20 Linux kernel 2.2.19 Linux kernel 2.2.18 Linux kernel 2.2.17 Linux kernel 2.2.16 Linux kernel 2.2.15 Linux kernel 2.2.14 Linux kernel 2.2.13 Linux kernel 2.2.12 Linux kernel 2.2.11 Linux kernel 2.2.10 Linux kernel 2.2.9 Linux kernel 2.2.8 Linux kernel 2.2.7 Linux kernel 2.2.6 Linux kernel 2.2.5 Linux kernel 2.2.4 Linux kernel 2.2.3 Linux kernel 2.2.2 Linux kernel 2.2.1 Linux kernel 2.2 |
| Not Vulnerable: | |
Discussion
Linux Kernel d_path() Path Truncation Vulnerability
The Linux kernel d_path() function converts a dentry structure into an ASCII path name. The full path to the specified dentry is returned in a fixed length buffer of size PAGE_SIZE bytes.
Reportedly, if a dentry structure is passed with a path which would exceed this length, an erroneous value is returned. The path which is returned has leading entries truncated, and no error is reported.
The Linux kernel d_path() function converts a dentry structure into an ASCII path name. The full path to the specified dentry is returned in a fixed length buffer of size PAGE_SIZE bytes.
Reportedly, if a dentry structure is passed with a path which would exceed this length, an erroneous value is returned. The path which is returned has leading entries truncated, and no error is reported.
Exploit / POC
Linux Kernel d_path() Path Truncation Vulnerability
A proof of concept exploit has been provided by Wojciech Purczynski <[email protected]>.
A proof of concept exploit has been provided by Wojciech Purczynski <[email protected]>.
Solution / Fix
Linux Kernel d_path() Path Truncation Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Linux Kernel d_path() Path Truncation Vulnerability
References:
References: