Description
The bdx_ioctl_priv function in the tehuti driver (tehuti.c) in Linux kernel 2.6.x before 2.6.25.1 does not properly check certain information related to register size, which has unspecified impact and local attack vectors, probably related to reading or writing kernel memory.
References
- ADV-2008-1406 vdb-entry
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0157
- MDVSA-2008:167 vendor-advisory
- FEDORA-2008-3873 vendor-advisory
- 20080507 rPSA-2008-0157-1 kernel mailing-list
- 30515 third-party-advisory
- 20080502 rPSA-2008-0157-1 kernel mailing-list
- USN-614-1 vendor-advisory
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.1
- 30044 third-party-advisory
- 1019960 vdb-entry
- 30017 third-party-advisory
- https://issues.rpath.com/browse/RPL-2501
- linux-kernel-tehuti-bo(42132) vdb-entry
- [linux-kernel] 20080429 [27/37] tehuti: move ioctl perm check closer to function start mailing-list
- [linux-kernel] 20080429 [04/12] tehuti: check register size (CVE-2008-1675) mailing-list
- 29014 vdb-entry
- 30260 third-party-advisory
- [linux-kernel] 20080429 [26/37] tehuti: check register size (CVE-2008-1675) mailing-list
- http://wiki.rpath.com/Advisories:rPSA-2008-0157
- MDVSA-2008:109 vendor-advisory