Vasiliy Kulikov
194b3da873
agp: fix arbitrary kernel memory writes
...
pg_start is copied from userspace on AGPIOC_BIND and AGPIOC_UNBIND ioctl
cmds of agp_ioctl() and passed to agpioc_bind_wrap(). As said in the
comment, (pg_start + mem->page_count) may wrap in case of AGPIOC_BIND,
and it is not checked at all in case of AGPIOC_UNBIND. As a result, user
with sufficient privileges (usually "video" group) may generate either
local DoS or privilege escalation.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-04-21 12:16:55 +10:00
..
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2011-04-07 11:14:49 -07:00
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2011-04-07 11:14:49 -07:00
2011-03-31 11:26:23 -03:00
2011-04-21 12:16:55 +10:00
2011-03-30 17:14:33 -07:00
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2011-03-22 17:44:12 -07:00
2011-04-07 12:48:45 -07:00
2011-04-07 11:14:49 -07:00
2011-03-31 11:26:23 -03:00
2011-03-22 17:44:15 -07:00
2011-03-31 11:26:23 -03:00
2011-04-20 10:45:21 +10:00
2011-04-07 11:14:49 -07:00
2011-04-07 11:14:49 -07:00
2011-03-18 17:15:11 -07:00
2011-03-31 11:26:23 -03:00
2011-04-07 11:14:49 -07:00
2011-03-17 14:05:34 +01:00
2011-03-31 11:26:23 -03:00
2011-04-07 11:14:49 -07:00
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2011-04-07 11:14:49 -07:00
2011-04-07 11:14:49 -07:00
2011-04-07 11:14:49 -07:00
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2011-04-07 11:31:03 -07:00
2011-04-07 11:14:49 -07:00
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2011-03-29 14:48:19 +02:00
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2011-04-07 12:12:58 -07:00
2011-04-08 07:36:14 -07:00
2011-03-31 11:26:23 -03:00
2011-04-07 11:14:49 -07:00
2011-03-31 11:26:23 -03:00
2011-03-30 00:15:49 +02:00
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2011-04-07 11:36:44 -07:00
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2011-04-07 12:48:45 -07:00
2011-03-31 11:26:23 -03:00
2011-04-07 11:14:49 -07:00
2011-03-31 11:26:23 -03:00
2011-03-13 23:08:19 +02:00
2011-04-07 12:49:17 -07:00
2011-03-28 19:33:04 +02:00
2011-03-31 11:26:23 -03:00
2011-04-07 20:20:24 +00:00
2011-03-31 11:26:23 -03:00