Description
The fill_write_buffer function in sysfs/file.c in Linux kernel 2.6.12 up to versions before 2.6.17-rc1 does not zero terminate a buffer when a length of PAGE_SIZE or more is requested, which might allow local users to cause a denial of service (crash) by causing an out-of-bounds read.
References
- 17402 vdb-entry
- 19735 third-party-advisory
- 20716 third-party-advisory
- USN-281-1 vendor-advisory
- FEDORA-2006-423 vendor-advisory
- 19495 third-party-advisory
- USN-302-1 vendor-advisory
- SUSE-SA:2006:028 vendor-advisory
- 19955 third-party-advisory
- ADV-2006-1475 vdb-entry
- ADV-2006-1273 vdb-entry
- http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6e0dd741a89be35defa05bd79f4211c5a2762825
- 20398 third-party-advisory
- 24443 vdb-entry
- 2006-0020 vendor-advisory
- linux-fillwritebuffer-dos(25693) vdb-entry
- http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=6e0dd741a89be35defa05bd79f4211c5a2762825%3Bhp=597a7679dd83691be2f3a53e1f3f915b4a7f6eba