Integer signedness error in the pkt_find_dev_from_minor function in
drivers/block/pktcdvd.c in the Linux kernel before 2.6.36-rc6 allows local
users to obtain sensitive information from kernel memory or cause a denial
of service (invalid pointer dereference and system crash) via a crafted
index value in a PKT_CTRL_CMD_STATUS ioctl call.
Dan Rosenberg discovered that the CD driver did not correctly check
parameters. A local attacker could exploit this to read arbitrary kernel
memory, leading to a loss of privacy.
smb> This was assigned to bradf and I re-assigned it to myself for minor
smb> fixups and so the tools will find things.
Updated: 2015-10-17 03:35:47 UTC (commit 10086)