![]() Struct tmp is copied from userspace. It is not checked whether the "name" field is NULL terminated. This may lead to buffer overflow and passing contents of kernel stack as a module name to try_then_request_module() and, consequently, to modprobe commandline. It would be seen by all userspace processes. Signed-off-by: Vasiliy Kulikov <segoon@openwall.com> Signed-off-by: Patrick McHardy <kaber@trash.net> |
||
---|---|---|
.. | ||
Kconfig | ||
Makefile | ||
ebt_802_3.c | ||
ebt_among.c | ||
ebt_arp.c | ||
ebt_arpreply.c | ||
ebt_dnat.c | ||
ebt_ip.c | ||
ebt_ip6.c | ||
ebt_limit.c | ||
ebt_log.c | ||
ebt_mark.c | ||
ebt_mark_m.c | ||
ebt_nflog.c | ||
ebt_pkttype.c | ||
ebt_redirect.c | ||
ebt_snat.c | ||
ebt_stp.c | ||
ebt_ulog.c | ||
ebt_vlan.c | ||
ebtable_broute.c | ||
ebtable_filter.c | ||
ebtable_nat.c | ||
ebtables.c |