Vulnerability

CERT-In Vulnerability Note CIVN-2008-0180
Linux Kernel 'hfs_cat_find_brec ' Local Denial of Service Vulnerability

Original Issue Date:November 21, 2008

Severity Rating: LOW

Systems Affected

Linux kernel versions prior to 2.6.27.6

Overview

A vulnerability was reported in the Linux Kernel, which allows local attacker to cause denial of service conditions.

Description

Linux kernel is prone to a local denial-of-service vulnerability because it fails to properly bounds-check data before copying it to an insufficiently sized memory buffer. The vulnerability is caused due to a boundary error in the "hfs_cat_find_brec " function and can be exploited to cause a buffer overflow via an overly large catalog name length.

The HFS file system is mainly used on Mac OS. The hfs_cat_find_brec function of fs/hfs/catalog.c file searches a record in a HFS catalog. However, if the size of the record name is longer than HFS_NAMELEN, a buffer overflow occurs in memcpy .
A local user can create a specially crafted HFS file system catalog name to trigger a buffer overflow in hfs_cat_find_brec and corrupt the stack.

Solution

Update to version 2.6.27.6.

Vendor Information

kernel.org
http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.6

References

SecurityFocus
http://www.securityfocus.com/bid/32289

SecurityTracker
http://www.securitytracker.com/alerts/2008/Nov/1021230.html

Juniper Networks
http://www.juniper.net/security/auto/vulnerabilities/vuln32289.html

CVE Name
CVE-2008-5025

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-2436857

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India