Sridhar Samudrala 96ec9da385
Fix sctp privilege elevation (CVE-2006-3745) ...
sctp_make_abort_user() now takes the msg_len along with the msg
so that we don't have to recalculate the bytes in iovec.
It also uses memcpy_fromiovec() so that we don't go beyond the
length allocated.
It is good to have this fix even if verify_iovec() is fixed to
return error on overflow.
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com >
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de >
2006-08-22 12:04:55 -07:00
2006-02-13 11:39:57 +01:00
2006-05-22 16:54:30 -07:00
2006-03-27 08:44:50 -08:00
2006-08-22 12:04:55 -07:00
2006-03-22 13:56:56 -08:00
2006-03-20 22:35:41 -08:00
2006-04-14 15:00:20 -07:00
2006-05-03 23:27:16 -07:00
2006-05-31 16:27:11 -07:00
2006-03-20 22:42:39 -08:00
2006-03-20 22:42:39 -08:00
2006-03-20 22:42:39 -08:00
2006-03-20 22:42:39 -08:00
2006-03-20 22:42:39 -08:00
2006-03-20 22:42:39 -08:00
2006-03-20 22:42:39 -08:00
2006-01-27 17:08:07 -05:00
2006-05-05 16:55:23 -04:00
2006-03-22 22:16:56 -05:00
2006-05-05 16:55:22 -04:00
2006-03-20 16:54:09 -08:00
2006-04-09 22:48:59 -07:00
2006-03-20 22:46:16 -08:00
2006-04-29 18:33:15 -07:00
2006-03-20 17:06:24 -08:00
2006-04-09 22:25:23 -07:00
2006-04-18 15:57:53 -07:00
2006-03-23 07:12:57 -05:00
2006-03-20 22:59:36 -08:00
2006-03-20 17:06:24 -08:00
2006-05-12 14:56:08 -07:00
2006-05-03 23:27:47 -07:00
2006-03-26 17:39:55 -08:00
2006-05-03 23:28:20 -07:00
2006-03-25 01:38:55 -08:00
2006-03-20 21:31:51 -08:00
2006-04-29 18:33:15 -07:00
2006-03-31 02:25:46 -08:00
2006-03-22 00:01:31 -08:00
2006-04-09 22:37:18 -07:00
2006-04-14 15:03:05 -07:00
Sridhar Samudrala
96ec9da385