Re: your mail

Zwane Mwaikambo
2002-06-24T09:11:59Z

On 24 Jun 2002 pah@promiscua.org wrote:

> I've just found a bug (an unsignificant bug) in the panic() function!
> There's a possible buffer overflow if the formated string exceeds
> 1024 characters (I think that the problem is in all kernel releases).
> The problem is in the use of vsprintf() insted of vsnprintf()!
>
> I know that this doesn't compromise any exploitation by an uid
> different than zero, but should be fixed in the case of panic()'s arguments
> exceeds the buffer limit (probably by an lkm or something like that) and
> cause (probably) a system crash.
>

In that case there are quite a number of other places in the kernel which
can be 'exploited' in various ways.

Cheers,
Zwane

--