diff options
| author | Vincenzo Maffione <vmaffione@FreeBSD.org> | 2022-03-16 06:57:54 +0000 |
|---|---|---|
| committer | Ed Maste <emaste@FreeBSD.org> | 2022-04-06 03:23:51 +0000 |
| commit | 9d354cf6e141a55ad1ef0cb85316f39013d594d2 (patch) | |
| tree | d03fb188b91dda36bbe8967ef755e0a9f0a1947a /sys/dev/netmap/netmap_monitor.c | |
| parent | 00cc1ce78da3543ebfa7172323cdaa8ca290b55f (diff) | |
netmap: Fix integer overflow in nmreq_copyin
An unsanitized field in an option could be abused, causing an integer
overflow followed by kernel memory corruption. This might be used
to escape jails/containers.
Reported by: Reno Robert and Lucas Leong (@_wmliang_) of Trend Micro
Zero Day Initiative
Security: CVE-2022-23085
(cherry picked from commit 694ea59c7021c25417e6d516362d2f59b4e2c343)
(cherry picked from commit 9df8dd3ea36c8b3abe8fc182647472ca9cd83efd)
Approved by: so, re (implicit)
Diffstat (limited to 'sys/dev/netmap/netmap_monitor.c')
0 files changed, 0 insertions, 0 deletions