Files
twx-linux/net
Sridhar Samudrala 28ea23d984 Fix sctp privilege elevation (CVE-2006-3745)
sctp_make_abort_user() now takes the msg_len along with the msg
so that we don't have to recalculate the bytes in iovec.
It also uses memcpy_fromiovec() so that we don't go beyond the
length allocated.

It is good to have this fix even if verify_iovec() is fixed to
return error on overflow.

Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Acked-by: David Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-08-23 18:01:55 +02:00
..
2006-02-13 15:38:42 -08:00
2006-01-11 18:42:14 -08:00
2006-03-19 13:20:06 -08:00
2006-03-04 21:06:29 -08:00
2006-08-08 23:23:12 +02:00
2006-01-11 18:42:14 -08:00
2006-02-09 16:59:48 -08:00
2006-01-11 18:42:14 -08:00
2006-01-17 13:03:54 -08:00
2006-03-08 14:14:01 -08:00
2006-01-11 18:42:14 -08:00
2006-01-12 14:06:31 -08:00
2006-01-03 13:11:17 -08:00