github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-08 14:42:37 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
ee360e99da
linux/drivers/video
History
Kees Cook 63db7c91a3 fbdev: color map copying bounds checking 
commit 2dc705a993 upstream.

Copying color maps to userspace doesn't check the value of to->start,
which will cause kernel heap buffer OOB read due to signedness wraps.

CVE-2016-8405

Link: http://lkml.kernel.org/r/20170105224249.GA50925@beast
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Peter Pi (@heisecode) of Trend Micro
Cc: Min Chong <mchong@google.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-02-01 08:30:52 +01:00
..
backlight - New Device Support 2015-11-06 10:53:48 -08:00
console fbcon: set a default value to blink interval 2016-03-09 15:34:50 -08:00
fbdev fbdev: color map copying bounds checking 2017-02-01 08:30:52 +01:00
logo video/logo: prevent use of logos after they have been freed 2014-12-29 10:06:55 +02:00
display_timing.c
hdmi.c [media] hdmi: rename HDMI_AUDIO_CODING_TYPE_EXT_STREAM to _EXT_CT 2015-01-27 10:19:12 -02:00
Kconfig drm: Remove two-level menu in Kconfig 2015-08-07 19:06:37 +02:00
Makefile
of_display_timing.c video: of: fix memory leak 2015-10-07 14:13:59 +03:00
of_videomode.c video: Fix possible leak in of_get_videomode() 2015-08-10 15:11:12 +03:00
vgastate.c fbdev: vgastate: remove trailing whitespaces 2015-01-13 12:53:25 +02:00
videomode.c