Sridhar Samudrala
c164a9ba0a
Fix sctp privilege elevation (CVE-2006-3745) ...
sctp_make_abort_user() now takes the msg_len along with the msg
so that we don't have to recalculate the bytes in iovec.
It also uses memcpy_fromiovec() so that we don't go beyond the
length allocated.
It is good to have this fix even if verify_iovec() is fixed to
return error on overflow.
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2006-08-22 12:52:23 -07:00
2006-07-03 19:54:02 -07:00
2006-07-02 13:58:51 -07:00
2006-06-20 15:10:08 -07:00
2006-08-22 12:52:23 -07:00
2006-06-25 23:38:29 -07:00
2006-04-26 12:56:16 +01:00
2006-08-02 14:12:06 -07:00
2006-04-14 15:00:20 -07:00
2006-07-03 19:30:18 -07:00
2006-06-20 15:10:08 -07:00
2006-04-26 12:56:16 +01:00
2006-07-14 21:53:56 -07:00
2006-04-26 12:56:16 +01:00
2006-06-15 15:48:13 -04:00
2006-04-24 16:15:58 -04:00
2006-07-05 13:42:58 -04:00
2006-04-26 12:56:16 +01:00
2006-04-26 12:56:16 +01:00
2006-04-26 12:56:16 +01:00
2006-05-06 19:59:18 +01:00
2006-08-02 13:38:14 -07:00
2006-04-26 12:56:16 +01:00
2006-04-26 12:56:16 +01:00
2006-04-26 12:56:16 +01:00
2006-06-20 15:10:08 -07:00
2006-08-02 13:38:14 -07:00
2006-06-17 21:26:08 -07:00
2006-04-26 12:56:16 +01:00
2006-05-12 14:56:08 -07:00
2006-08-02 15:02:31 -07:00
2006-08-02 13:38:20 -07:00
2006-05-03 23:27:47 -07:00
2006-04-26 12:56:16 +01:00
2006-07-24 12:44:23 -07:00
2006-07-08 13:34:56 -07:00
2006-06-20 15:10:08 -07:00
2006-08-04 22:59:51 -07:00
2006-05-03 23:28:20 -07:00
2006-04-26 12:56:16 +01:00
2006-04-26 12:56:16 +01:00
2006-08-02 14:12:06 -07:00
2006-07-03 15:27:10 -07:00
2006-06-30 14:12:10 -07:00
2006-08-02 13:38:19 -07:00
2006-04-09 22:37:18 -07:00
2006-06-17 21:28:43 -07:00
c164a9ba0a