New: Security Issure:
https://bugzilla.kernel.org/show_bug.cgi?id=110801
Bug ID: 110801
Summary: Security Issure:
Product: IO/Storage
Version: 2.5
Kernel Version: 4.3.3
Hardware: All
OS: Linux
Tree: Mainline
Status: NEW
Severity: normal
Priority: P1
Component: SCSI
Assignee: [email protected]
Reporter: [email protected]
Regression: NoSignature · 2 lines
You are receiving this mail because: You are the assignee for the bug.
[Bug 110801] Security Issure: query_disk in aacraid
https://bugzilla.kernel.org/show_bug.cgi?id=110801
Yong Shi <[email protected]> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|Security Issure: |Security Issure: query_disk
| |in aacraid
Severity|normal |highSignature · 2 lines
You are receiving this mail because: You are the assignee for the bug.
[Bug 110801] Security Issure: query_disk in aacraid
In reply to [email protected]https://bugzilla.kernel.org/show_bug.cgi?id=110801
--- Comment #1 from Yong Shi <[email protected]> --- aachba.c
line 2856: Calling function copy_from_user taints argument qd
line 2858: if the attacker set the qd.cnum to -1 , the attacker could set the
qd.cnum to anyvalue ( line 2859 qd.cnum = qd.id)
line 2871: Untrusted pointer read fsa_dev_ptr[qd.cnum]
Signature · 2 lines
You are receiving this mail because: You are the assignee for the bug.