• Vasiliy Kulikov's avatar
    agp: fix arbitrary kernel memory writes · 194b3da8
    Vasiliy Kulikov authored
    pg_start is copied from userspace on AGPIOC_BIND and AGPIOC_UNBIND ioctl
    cmds of agp_ioctl() and passed to agpioc_bind_wrap().  As said in the
    comment, (pg_start + mem->page_count) may wrap in case of AGPIOC_BIND,
    and it is not checked at all in case of AGPIOC_UNBIND.  As a result, user
    with sufficient privileges (usually "video" group) may generate either
    local DoS or privilege escalation.
    Signed-off-by: default avatarVasiliy Kulikov <segoon@openwall.com>
    Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
    194b3da8
generic.c 36.6 KB