CVE-2012-0044
Priority
Medium
Description
There is a potential integer overflow in drm_mode_dirtyfb_ioctl() if
userspace passes in a large num_clips. The call to kmalloc would
allocate a small buffer, and the call to fb->funcs->dirty may result in
a memory corruption.
userspace passes in a large num_clips. The call to kmalloc would
allocate a small buffer, and the call to fb->funcs->dirty may result in
a memory corruption.
Ubuntu-Description
Chen Haogang discovered an integer overflow that could result in memory
corruption. A local unprivileged user could use this to crash the system.
corruption. A local unprivileged user could use this to crash the system.
References
Package
| Upstream: | released (3.2~rc3) |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | not-affected |
| Ubuntu 10.10 (Maverick Meerkat): | ignored (binary supplied by "linux" now) |
| Ubuntu 11.04 (Natty Narwhal): | DNE |
| Ubuntu 11.10 (Oneiric Ocelot): | DNE |
| Ubuntu 12.04 LTS (Precise Pangolin): | DNE |
Package
| Upstream: | released (3.2~rc3) |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | released (3.0.0-15.25~lucid1) |
| Ubuntu 10.10 (Maverick Meerkat): | DNE |
| Ubuntu 11.04 (Natty Narwhal): | DNE |
| Ubuntu 11.10 (Oneiric Ocelot): | DNE |
| Ubuntu 12.04 LTS (Precise Pangolin): | DNE |
Package
| Upstream: | released (3.2~rc3) |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | pending (2.6.38-13.55~lucid1) |
| Ubuntu 10.10 (Maverick Meerkat): | DNE |
| Ubuntu 11.04 (Natty Narwhal): | DNE |
| Ubuntu 11.10 (Oneiric Ocelot): | DNE |
| Ubuntu 12.04 LTS (Precise Pangolin): | DNE |
Package
| Upstream: | released (3.2~rc3) |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | not-affected |
| Ubuntu 10.10 (Maverick Meerkat): | not-affected |
| Ubuntu 11.04 (Natty Narwhal): | DNE |
| Ubuntu 11.10 (Oneiric Ocelot): | DNE |
| Ubuntu 12.04 LTS (Precise Pangolin): | DNE |
Package
| Upstream: | released (3.2~rc3) |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | pending (2.6.35-32.65~lucid1) |
| Ubuntu 10.10 (Maverick Meerkat): | DNE |
| Ubuntu 11.04 (Natty Narwhal): | DNE |
| Ubuntu 11.10 (Oneiric Ocelot): | DNE |
| Ubuntu 12.04 LTS (Precise Pangolin): | DNE |
Package
| Upstream: | released (3.2~rc3) |
| Ubuntu 8.04 LTS (Hardy Heron): | not-affected |
| Ubuntu 10.04 LTS (Lucid Lynx): | not-affected |
| Ubuntu 10.10 (Maverick Meerkat): | released (2.6.35-32.65) |
| Ubuntu 11.04 (Natty Narwhal): | released (2.6.38-13.55) |
| Ubuntu 11.10 (Oneiric Ocelot): | released (3.0.0-15.24) |
| Ubuntu 12.04 LTS (Precise Pangolin): | not-affected (3.2.0-2.4) |
Patches:
| Introduced by 884840aa3ce3214259e69557be5b4ce0d781ffa4 | Fixed by a5cd335165e31db9dbab636fd29895d41da55dd2 |
Package
| Upstream: | released (3.2~rc3) |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | DNE |
| Ubuntu 10.10 (Maverick Meerkat): | pending (2.6.35-903.30) |
| Ubuntu 11.04 (Natty Narwhal): | released (2.6.38-1209.21) |
| Ubuntu 11.10 (Oneiric Ocelot): | released (3.0.0-1206.14) |
| Ubuntu 12.04 LTS (Precise Pangolin): | not-affected (3.2.0-1401.1) |
Package
| Upstream: | released (3.2~rc3) |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | not-affected |
| Ubuntu 10.10 (Maverick Meerkat): | DNE |
| Ubuntu 11.04 (Natty Narwhal): | DNE |
| Ubuntu 11.10 (Oneiric Ocelot): | DNE |
| Ubuntu 12.04 LTS (Precise Pangolin): | DNE |