From ad4c196a84b161214275b73fbc08fedd5959c715 Mon Sep 17 00:00:00 2001 From: Dave Jones Date: Wed, 21 Apr 2004 21:49:59 +0100 Subject: [PATCH] [CPUFREQ] Fix security hole in proc handler. Brad Spengler found an exploitable bug in the proc handler of cpufreq, where a user-supplied unsigned int is cast to a signed int and then passed on to copy_[to|from]_user() allowing arbitary amounts of memory to be written (root only thankfully), or read (as any user). The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0228 to this issue. --- drivers/cpufreq/cpufreq_userspace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/cpufreq/cpufreq_userspace.c b/drivers/cpufreq/cpufreq_userspace.c index fb26de827f608..99ac1419dc79c 100644 --- a/drivers/cpufreq/cpufreq_userspace.c +++ b/drivers/cpufreq/cpufreq_userspace.c @@ -168,7 +168,7 @@ cpufreq_procctl(ctl_table *ctl, int write, struct file *filp, { char buf[16], *p; int cpu = (long) ctl->extra1; - int len, left = *lenp; + unsigned int len, left = *lenp; if (!left || (filp->f_pos && !write) || !cpu_online(cpu)) { *lenp = 0; -- 2.53.0