Timo Warns 3eb8e74ec7
fs/partitions/efi.c: corrupted GUID partition tables can cause kernel oops ...
The kernel automatically evaluates partition tables of storage devices.
The code for evaluating GUID partitions (in fs/partitions/efi.c) contains
a bug that causes a kernel oops on certain corrupted GUID partition
tables.
This bug has security impacts, because it allows, for example, to
prepare a storage device that crashes a kernel subsystem upon connecting
the device (e.g., a "USB Stick of (Partial) Death").
crc = efi_crc32((const unsigned char *) (*gpt), le32_to_cpu((*gpt)->header_size));
computes a CRC32 checksum over gpt covering (*gpt)->header_size bytes.
There is no validation of (*gpt)->header_size before the efi_crc32 call.
A corrupted partition table may have large values for (*gpt)->header_size.
In this case, the CRC32 computation access memory beyond the memory
allocated for gpt, which may cause a kernel heap overflow.
Validate value of GUID partition table header size.
[akpm@linux-foundation.org: fix layout and indenting]
Signed-off-by: Timo Warns <warns@pre-sense.de>
Cc: Matt Domsch <Matt_Domsch@dell.com>
Cc: Eugene Teo <eugeneteo@kernel.sg>
Cc: Dave Jones <davej@codemonkey.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-05-26 17:12:37 -07:00
2011-05-26 09:52:14 -07:00
2011-03-31 11:26:23 -03:00
2011-05-26 07:26:48 -04:00
2011-05-26 07:26:48 -04:00
2011-05-26 07:26:47 -04:00
2011-03-31 11:26:23 -03:00
2011-05-26 07:26:48 -04:00
2011-05-26 10:50:56 -07:00
2011-03-31 11:26:23 -03:00
2011-05-26 07:26:53 -04:00
2011-05-26 07:26:59 -04:00
2011-05-26 07:26:48 -04:00
2011-05-26 09:52:14 -07:00
2011-01-13 08:03:23 -08:00
2011-05-19 16:55:28 +09:30
2011-03-22 17:44:17 -07:00
2011-05-26 13:19:00 -07:00
2011-05-26 07:26:48 -04:00
2011-03-10 08:52:07 +01:00
2011-05-26 07:26:57 -04:00
2011-03-15 02:21:44 -04:00
2011-05-26 07:26:56 -04:00
2011-05-26 10:50:56 -07:00
2011-05-26 10:50:56 -07:00
2011-05-26 09:52:14 -07:00
2011-05-10 10:16:21 +02:00
2011-05-25 08:39:44 -07:00
2011-05-26 09:52:14 -07:00
2011-05-26 13:19:00 -07:00
2011-05-26 07:26:48 -04:00
2011-05-26 07:26:48 -04:00
2011-05-26 07:26:48 -04:00
2011-05-26 09:52:14 -07:00
2011-01-07 17:50:26 +11:00
2011-05-26 09:20:31 -07:00
2011-03-24 10:16:26 -07:00
2011-05-24 00:27:53 +02:00
2011-05-26 09:53:20 -07:00
2011-05-26 07:26:48 -04:00
2011-05-26 07:26:48 -04:00
2011-01-25 15:24:47 -05:00
2011-05-26 09:52:14 -07:00
2011-05-26 07:26:48 -04:00
2011-05-26 17:12:36 -07:00
2011-05-26 07:26:57 -04:00
2011-03-31 11:26:23 -03:00
2011-05-10 10:16:21 +02:00
2011-05-26 09:52:14 -07:00
2011-04-07 11:14:49 -07:00
2011-03-31 11:26:23 -03:00
2011-05-26 10:55:15 -07:00
2011-05-26 07:26:48 -04:00
2011-01-07 17:50:26 +11:00
2011-05-26 17:12:37 -07:00
2011-05-26 17:12:37 -07:00
2011-05-16 11:05:00 -07:00
2011-03-10 08:52:07 +01:00
2011-05-25 08:39:26 -07:00
2011-04-14 16:06:56 -07:00
2011-05-26 07:26:48 -04:00
2011-01-07 17:50:26 +11:00
2011-05-10 10:16:21 +02:00
2011-05-13 16:05:51 -07:00
2011-05-26 07:26:48 -04:00
2011-05-26 09:52:14 -07:00
2011-05-26 07:26:48 -04:00
2011-05-26 17:12:33 -07:00
2011-05-26 10:49:11 -07:00
2011-03-24 10:16:26 -07:00
2011-01-16 13:47:07 -05:00
2011-03-31 11:26:23 -03:00
2011-01-07 17:50:29 +11:00
2010-10-14 10:57:40 -07:00
2010-06-01 08:11:06 -07:00
2011-04-14 16:06:55 -07:00
2010-03-30 22:02:32 +09:00
2011-05-03 10:10:51 +10:00
2010-10-29 04:16:28 -04:00
2010-08-17 18:07:43 -07:00
2010-01-29 08:22:01 -08:00
2011-03-17 11:11:05 +01:00
2011-03-31 11:26:23 -03:00
2011-05-23 08:50:48 -07:00
2011-05-26 10:50:56 -07:00
2011-01-13 10:45:01 -08:00
2010-03-06 11:26:45 -08:00
2011-01-07 14:39:20 -08:00
2011-04-09 15:53:56 +02:00
2011-05-25 08:39:26 -07:00
2011-03-24 10:16:26 -07:00
2011-05-25 08:39:26 -07:00
2011-02-21 15:07:04 -08:00
2011-03-31 11:26:23 -03:00
2011-05-26 17:12:36 -07:00
2011-03-23 19:47:13 -07:00
2011-04-14 16:06:56 -07:00
2011-03-21 00:16:09 -04:00
2011-03-16 13:26:17 -07:00
2011-04-28 11:28:20 -07:00
2011-04-17 10:42:01 -07:00
2011-01-16 13:47:07 -05:00
2011-03-31 11:26:23 -03:00
2011-03-23 19:47:13 -07:00
2011-05-25 08:39:26 -07:00
2011-03-24 21:17:51 -04:00
2011-03-21 00:16:08 -04:00
2010-11-15 10:23:31 +01:00
2011-05-26 09:52:14 -07:00
2010-10-27 18:03:12 -07:00
2011-05-26 07:26:50 -04:00
2011-03-24 08:20:39 -07:00
2011-03-16 19:01:29 -07:00
2011-05-25 08:39:26 -07:00
2011-05-26 10:01:43 -06:00
2011-05-26 09:52:14 -07:00
2011-05-26 07:26:44 -04:00
2011-03-14 09:15:28 -04:00
2010-10-15 15:53:27 +02:00
2011-03-21 01:10:41 -04:00
2011-01-20 16:21:59 -08:00
2011-01-07 17:50:33 +11:00
2010-03-03 14:07:55 -05:00
2011-01-25 15:24:47 -05:00
2011-01-12 20:06:58 -05:00
2010-08-09 20:45:05 -07:00
2011-03-21 00:16:08 -04:00
2010-10-25 21:26:12 -04:00
2010-10-26 10:13:10 -07:00
2011-05-23 19:58:53 +02:00
2009-12-17 10:58:17 -05:00
2011-03-15 02:21:45 -04:00
2011-03-14 09:15:28 -04:00
2011-05-26 10:50:56 -07:00
2011-03-24 10:16:26 -07:00
2011-05-23 13:59:53 +02:00
2011-03-23 19:47:13 -07:00
2010-03-30 22:02:32 +09:00
2011-04-21 07:34:44 -07:00
3eb8e74ec7