kernel-packages team mailing list archive
Mailing list archive
[Bug 1555353] Re: integer overflow in xt_alloc_table_info
** Branch linked: lp:ubuntu/trusty-proposed/linux-lts-xenial
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
integer overflow in xt_alloc_table_info
Status in linux package in Ubuntu:
Status in linux source package in Wily:
Status in linux source package in Xenial:
[From https://code.google.com/p/google-security-research/issues/detail?id=758 ]
A recent refactoring cof this codepath
introduced an integer overflow in xt_alloc_table_info, which on 32-bit
systems can lead to small structure allocation and a copy_from_user
based heap corruption.
More specifically, the overflow may have been introduced in
; specifically the bit:
+ size_t sz = sizeof(*info) + size;
(where size is an unsigned int passed from userspace).
This issue should only affect 32bit platforms (xt_table_info.size is
an unsigned int).
Upstream proposed fix: http://marc.info/?l=netfilter-devel&m=145757136822750&w=2
Download v4 code from: https://code.google.com/p/google-security-research/issues/detail?id=758
gcc *v4.c -o v4
Your machine should _not_ crash. This only affects 32-bit kernels
To manage notifications about this bug go to: