]> www.infradead.org Git - users/jedix/linux-maple.git/commit
cdrom: fix improper type cast, which can leat to information leak.
authorYoung_X <YangX92@hotmail.com>
Wed, 3 Oct 2018 12:54:29 +0000 (12:54 +0000)
committerBrian Maly <brian.maly@oracle.com>
Tue, 20 Nov 2018 19:04:40 +0000 (14:04 -0500)
commit7c2093cdf2e2782be98c01514e1d7cf20c254a8e
tree9b58117ab9c4ed32fb3dd12cdea8f5953a50ce22
parent8bf5286f37eca5f7ed02c3f0d9901a1eb4e3a1b3
cdrom: fix improper type cast, which can leat to information leak.

There is another cast from unsigned long to int which causes
a bounds check to fail with specially crafted input. The value is
then used as an index in the slot array in cdrom_slot_status().

This issue is similar to CVE-2018-16658 and CVE-2018-10940.

Signed-off-by: Young_X <YangX92@hotmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
(cherry picked from commit e4f3aa2e1e67bb48dfbaaf1cad59013d5a5bc276)

Orabug: 28929767
CVE: CVE-2018-18710

Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Signed-off-by: Allen Pais <allen.pais@oracle.com>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
drivers/cdrom/cdrom.c