Bug 905744

Summary:	VUL-0: kernel: ttusb-dec: buffer overflow in ioctl
Product:	[openSUSE] openSUSE 13.1	Reporter:	Oliver Neukum <oneukum>
Component:	Security	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	E-mail List <qa-bugs>
Severity:	Normal
Priority:	P3 - Medium	CC:	jsegitz, oneukum
Version:	Final
Target Milestone:	---
Hardware:	x86-64
OS:	SLED 12
Whiteboard:	CVSSv2:NVD:CVE-2014-8884:6.1:(AV:L/AC:L/Au:N/C:P/I:P/A:C) CVSSv2:RedHat:CVE-2014-8884:6.0:(AV:L/AC:H/Au:S/C:C/I:C/A:C)
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Bug Depends on:	904876, 905748, 905764
Bug Blocks:	905522, 905739

Description Oliver Neukum 2014-11-17 13:40:16 UTC

+++ This bug was initially created as a clone of Bug #904876 +++

This is from upstream. This buffer can be overflown from an ioctl. The fix is available upstream. It has not gone into stable.

commit f2e323ec96077642d397bb1c355def536d489d16
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Fri Sep 5 09:09:28 2014 -0300

    [media] ttusb-dec: buffer overflow in ioctl
    
    We need to add a limit check here so we don't overflow the buffer.

The current SLE12 kernel does not have the fix. It can be triggered only if you have the hardware.

Comment 1 Oliver Neukum 2014-11-17 15:47:42 UTC

Fix added to tree

Comment 2 Swamp Workflow Management 2014-11-17 23:00:52 UTC

bugbot adjusting priority

Comment 3 Oliver Neukum 2014-11-20 11:58:54 UTC

Fix added to tree

Comment 4 Swamp Workflow Management 2014-12-21 12:11:58 UTC

openSUSE-SU-2014:1677-1: An update that solves 31 vulnerabilities and has 12 fixes is now available.

Category: security (important)
Bug References: 818966,835839,853040,856659,864375,865882,873790,875051,881008,882639,882804,883518,883724,883948,883949,884324,887046,887082,889173,890114,891689,892490,893429,896382,896385,896390,896391,896392,896689,897736,899785,900392,902346,902349,902351,904013,904700,905100,905744,907818,908163,909077,910251
CVE References: CVE-2013-2891,CVE-2013-2898,CVE-2014-0181,CVE-2014-0206,CVE-2014-1739,CVE-2014-3181,CVE-2014-3182,CVE-2014-3184,CVE-2014-3185,CVE-2014-3186,CVE-2014-3673,CVE-2014-3687,CVE-2014-3688,CVE-2014-4171,CVE-2014-4508,CVE-2014-4608,CVE-2014-4611,CVE-2014-4943,CVE-2014-5077,CVE-2014-5206,CVE-2014-5207,CVE-2014-5471,CVE-2014-5472,CVE-2014-6410,CVE-2014-7826,CVE-2014-7841,CVE-2014-7975,CVE-2014-8133,CVE-2014-8709,CVE-2014-9090,CVE-2014-9322
Sources used:
openSUSE 13.1 (src):    cloop-2.639-11.16.1, crash-7.0.2-2.16.1, hdjmod-1.28-16.16.1, ipset-6.21.1-2.20.1, iscsitarget-1.4.20.3-13.16.1, kernel-docs-3.11.10-25.2, kernel-source-3.11.10-25.1, kernel-syms-3.11.10-25.1, ndiswrapper-1.58-16.1, pcfclock-0.44-258.16.1, vhba-kmp-20130607-2.17.1, virtualbox-4.2.18-2.21.1, xen-4.3.2_02-30.1, xtables-addons-2.3-2.16.1