Bug 57096 (CVE-2004-0496) - VUL-0: CVE-2004-0496: kernel: root hole in airo driver
Summary: VUL-0: CVE-2004-0496: kernel: root hole in airo driver
Status: RESOLVED FIXED
Alias: CVE-2004-0496
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: All Linux
: P3 - Medium : Blocker
Target Milestone: ---
Assignee: Thomas Biege
QA Contact: E-mail List
URL:
Whiteboard: CVE-2004-0496: CVSS v2 Base Score: 7....
Keywords:
Depends on:
Blocks:
 
Reported: 2004-06-16 20:48 UTC by Andreas Kleen
Modified: 2021-10-02 09:30 UTC (History)
1 user (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
patch to fix the hole (2.43 KB, patch)
2004-06-16 20:48 UTC, Andreas Kleen 		Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Kleen 2004-06-16 20:48:02 UTC 
From 2.6.7rc3

airo proc read/write could be overflowed, writing all memory.
Comment 1 Andreas Kleen 2004-06-16 20:48:34 UTC 
Created attachment 21268 [details]
patch to fix the hole
Comment 2 Hubert Mantel 2004-06-16 23:39:40 UTC 
Patch applied to CVS head.
Comment 3 Kurt Garloff 2004-06-17 08:18:25 UTC 
And copied ovwer to SLES9_GA_BRANCH.
Comment 4 Andreas Kleen 2004-06-17 08:37:02 UTC 
<!-- SBZ_reopen -->Reopened by ak@suse.de at Thu Jun 17 02:37:02 2004
Comment 5 Andreas Kleen 2004-06-17 08:37:02 UTC 
Older maintained trees need to be checked too
Comment 6 Andreas Kleen 2004-06-18 00:08:45 UTC 
Retarget to SLES8 for now
Comment 7 Thomas Biege 2004-06-18 16:53:22 UTC 
quote: 
CAN-2004-0495: Flaws in the Linux 2.4 and 2.6 kernel decnet, mpu401, pss, 
airo, msnd, and asus_pci drivers which can lead to information leaks, DoS, 
or privilege escalation. 
 
(so use CAN-2004-0495 for the patch Al Viro posted earlier if you're 
fixing your 2.4 kernels) 
 
CAN-2004-0496: Flaws in the Linux 2.6 kernel various drivers which can 
lead to information leaks, DoS, or privilege escalation, in addition to 
those in CAN-2004-0495. 
 
(so use CAN-2004-0495 and CAN-2004-0496 if you're fixing your 2.6 kernels 
with the big overall initial Al Viro patch).
Comment 8 Hubert Mantel 2004-06-21 23:15:52 UTC 
Fixes are in all maintained trees. Packages are waiting for check in.
Comment 9 Thomas Biege 2004-07-05 16:11:15 UTC 
packages approved
Comment 10 Thomas Biege 2009-10-13 20:26:27 UTC 
CVE-2004-0496: CVSS v2 Base Score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)