From ffe7508bb3f3343e72cead2a6c5a6a6218d474d2 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 13 Nov 2018 17:20:20 -0800 Subject: [PATCH] 3.18-stable patches added patches: cdrom-fix-improper-type-cast-which-can-leat-to-information-leak.patch --- ...t-which-can-leat-to-information-leak.patch | 35 +++++++++++++++++++ queue-3.18/series | 1 + 2 files changed, 36 insertions(+) create mode 100644 queue-3.18/cdrom-fix-improper-type-cast-which-can-leat-to-information-leak.patch diff --git a/queue-3.18/cdrom-fix-improper-type-cast-which-can-leat-to-information-leak.patch b/queue-3.18/cdrom-fix-improper-type-cast-which-can-leat-to-information-leak.patch new file mode 100644 index 00000000000..881bc947304 --- /dev/null +++ b/queue-3.18/cdrom-fix-improper-type-cast-which-can-leat-to-information-leak.patch @@ -0,0 +1,35 @@ +From e4f3aa2e1e67bb48dfbaaf1cad59013d5a5bc276 Mon Sep 17 00:00:00 2001 +From: Young_X +Date: Wed, 3 Oct 2018 12:54:29 +0000 +Subject: cdrom: fix improper type cast, which can leat to information leak. + +From: Young_X + +commit e4f3aa2e1e67bb48dfbaaf1cad59013d5a5bc276 upstream. + +There is another cast from unsigned long to int which causes +a bounds check to fail with specially crafted input. The value is +then used as an index in the slot array in cdrom_slot_status(). + +This issue is similar to CVE-2018-16658 and CVE-2018-10940. + +Signed-off-by: Young_X +Signed-off-by: Jens Axboe +Cc: Ben Hutchings +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cdrom/cdrom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/cdrom/cdrom.c ++++ b/drivers/cdrom/cdrom.c +@@ -2424,7 +2424,7 @@ static int cdrom_ioctl_select_disc(struc + return -ENOSYS; + + if (arg != CDSL_CURRENT && arg != CDSL_NONE) { +- if ((int)arg >= cdi->capacity) ++ if (arg >= cdi->capacity) + return -EINVAL; + } + diff --git a/queue-3.18/series b/queue-3.18/series index 4eea1b172c4..b84a02f2938 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -60,3 +60,4 @@ mips-kexec-mark-cpu-offline-before-disabling-local-irq.patch powerpc-boot-ensure-_zimage_start-is-a-weak-symbol.patch media-tvp5150-fix-width-alignment-during-set_selection.patch 9p-clear-dangling-pointers-in-p9stat_free.patch +cdrom-fix-improper-type-cast-which-can-leat-to-information-leak.patch -- 2.47.2