Sridhar Samudrala c164a9ba0a
Fix sctp privilege elevation (CVE-2006-3745) ...
sctp_make_abort_user() now takes the msg_len along with the msg
so that we don't have to recalculate the bytes in iovec.
It also uses memcpy_fromiovec() so that we don't go beyond the
length allocated.
It is good to have this fix even if verify_iovec() is fixed to
return error on overflow.
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com >
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de >
2006-08-22 12:52:23 -07:00
2006-06-30 19:25:36 +02:00
2006-07-24 13:52:13 -07:00
2006-07-21 14:51:30 -07:00
2006-08-17 16:29:53 -07:00
2006-07-21 14:51:30 -07:00
2006-07-24 12:44:25 -07:00
2006-08-17 18:22:32 -07:00
2006-08-17 16:29:56 -07:00
2006-08-02 13:38:14 -07:00
2006-08-02 14:14:44 -07:00
2006-07-21 14:51:30 -07:00
2006-06-30 19:25:36 +02:00
2006-07-27 14:37:31 -04:00
2006-08-17 18:13:53 -07:00
2006-08-17 16:29:57 -07:00
2006-08-09 17:36:15 -07:00
2006-07-21 14:51:30 -07:00
2006-06-30 19:25:36 +02:00
2006-08-05 21:15:58 -07:00
2006-08-13 18:56:26 -07:00
2006-08-17 18:12:38 -07:00
2006-07-21 14:51:30 -07:00
2006-07-12 13:59:02 -07:00
2006-06-30 19:25:36 +02:00
2006-07-12 13:58:59 -07:00
2006-07-21 14:51:30 -07:00
2006-08-17 16:29:54 -07:00
2006-08-22 12:52:23 -07:00
2006-08-06 08:57:47 -07:00
2006-07-21 15:52:20 -07:00
2006-08-02 14:12:06 -07:00
2006-07-21 14:51:30 -07:00
2006-06-30 19:25:36 +02:00
2006-08-13 18:55:53 -07:00
2006-04-01 02:25:19 -08:00
2006-06-17 21:29:57 -07:00
2006-01-12 14:06:31 -08:00
2006-03-28 09:16:06 -08:00
2006-06-30 19:25:36 +02:00
2006-06-30 19:25:36 +02:00
2005-04-16 15:20:36 -07:00
c164a9ba0a