Multiple integer signedness errors in the TIPC implementation in the...

Vulnerability Description

Multiple integer signedness errors in the TIPC implementation in the Linux kernel before 2.6.36.2 allow local users to gain privileges via a crafted sendmsg call that triggers a heap-based buffer overflow, related to the tipc_msg_build function in net/tipc/msg.c and the verify_iovec function in net/core/iovec.c.

References

• http://secunia.com/advisories/42789
• http://www.vupen.com/english/advisories/2011/0024
• http://www.redhat.com/support/errata/RHSA-2011-0004.html
• http://marc.info/?l=linux-netdev&m=128770476511716&w=2
• http://www.spinics.net/lists/netdev/msg145264.html
• http://www.securityfocus.com/archive/1/520102/100/0/threaded
• http://secunia.com/advisories/46397
• http://www.spinics.net/lists/netdev/msg145263.html
• https://bugzilla.redhat.com/show_bug.cgi?id=645867
• http://www.spinics.net/lists/netdev/msg145247.html
• http://www.spinics.net/lists/netdev/msg145352.html
• http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36.2
• http://www.openwall.com/lists/oss-security/2010/10/22/2
• http://secunia.com/advisories/42963
• http://www.securityfocus.com/bid/44354
• http://www.spinics.net/lists/netdev/msg145262.html
• http://www.vmware.com/security/advisories/VMSA-2011-0012.html
• http://www.redhat.com/support/errata/RHSA-2011-0162.html
• http://www.spinics.net/lists/netdev/msg145265.html
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8acfe468b0384e834a303f08ebc4953d72fb690a
• http://www.vupen.com/english/advisories/2011/0168
• http://www.mandriva.com/security/advisories?name=MDVSA-2011:029
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=253eacc070b114c2ec1f81b067d2fed7305467b0
• http://www.spinics.net/lists/netdev/msg145248.html
• http://www.openwall.com/lists/oss-security/2010/10/22/5
• http://www.debian.org/security/2010/dsa-2126