From: Greg Kroah-Hartman Date: Wed, 14 Nov 2018 00:32:29 +0000 (-0800) Subject: 4.4-stable patches X-Git-Tag: v4.19.3~61 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=dddadbf096d95d07a9c3843fbd63a91fa922114f;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: cdrom-fix-improper-type-cast-which-can-leat-to-information-leak.patch --- diff --git a/queue-4.4/cdrom-fix-improper-type-cast-which-can-leat-to-information-leak.patch b/queue-4.4/cdrom-fix-improper-type-cast-which-can-leat-to-information-leak.patch new file mode 100644 index 00000000000..df551a6114f --- /dev/null +++ b/queue-4.4/cdrom-fix-improper-type-cast-which-can-leat-to-information-leak.patch @@ -0,0 +1,35 @@ +From e4f3aa2e1e67bb48dfbaaf1cad59013d5a5bc276 Mon Sep 17 00:00:00 2001 +From: Young_X +Date: Wed, 3 Oct 2018 12:54:29 +0000 +Subject: cdrom: fix improper type cast, which can leat to information leak. + +From: Young_X + +commit e4f3aa2e1e67bb48dfbaaf1cad59013d5a5bc276 upstream. + +There is another cast from unsigned long to int which causes +a bounds check to fail with specially crafted input. The value is +then used as an index in the slot array in cdrom_slot_status(). + +This issue is similar to CVE-2018-16658 and CVE-2018-10940. + +Signed-off-by: Young_X +Signed-off-by: Jens Axboe +Cc: Ben Hutchings +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cdrom/cdrom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/cdrom/cdrom.c ++++ b/drivers/cdrom/cdrom.c +@@ -2425,7 +2425,7 @@ static int cdrom_ioctl_select_disc(struc + return -ENOSYS; + + if (arg != CDSL_CURRENT && arg != CDSL_NONE) { +- if ((int)arg >= cdi->capacity) ++ if (arg >= cdi->capacity) + return -EINVAL; + } + diff --git a/queue-4.4/series b/queue-4.4/series index e03189d5680..6a5e56ce9e4 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -105,3 +105,4 @@ sc16is7xx-fix-for-multi-channel-stall.patch media-tvp5150-fix-width-alignment-during-set_selection.patch 9p-locks-fix-glock.client_id-leak-in-do_lock.patch 9p-clear-dangling-pointers-in-p9stat_free.patch +cdrom-fix-improper-type-cast-which-can-leat-to-information-leak.patch