[Full-disclosure] Linux Kernel CIFS Vulnerability

[Andreas Bogk <andreas@xxxxxxxxxxx>]

Dear list,

as discovered by Felix von Leitner (http://blog.fefe.de/?ts=b72905a8), 
Linux kernel patch 2.6.29.1 contains:

--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -3667,7 +3667,7 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
                            BCC(smb_buffer_response)) {
                                kfree(tcon->nativeFileSystem);
                                tcon->nativeFileSystem =
-                                   kzalloc(length + 2, GFP_KERNEL);
+                                   kzalloc(2*(length + 1), GFP_KERNEL);
                                if (tcon->nativeFileSystem)
                                        cifs_strfromUCS_le(
                                                tcon->nativeFileSystem,

fixing a remotely exploitable buffer overflow vulnerability in the CIFS 
protocol.

Neither the Linux kernel team, the CIFS maintainers nor any of the commercial 
Linux distributors bothered to send out an advisory.
I'm at loss for words other than "irresponsible, arrogant assholes".  Linux 
2009 == Microsoft 2002.

Andreas



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/