Kees Cook e0e29b683d b43: stop format string leaking into error msgs
The module parameter "fwpostfix" is userspace controllable, unfiltered,
and is used to define the firmware filename. b43_do_request_fw() populates
ctx->errors[] on error, containing the firmware filename. b43err()
parses its arguments as a format string. For systems with b43 hardware,
this could lead to a uid-0 to ring-0 escalation.

CVE-2013-2852

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-06-12 10:20:59 -04:00
..
2013-05-09 16:33:42 -07:00
2013-05-07 11:22:14 -07:00
2013-05-17 14:31:05 -04:00
2013-05-07 20:16:25 -07:00
2013-04-29 00:08:46 +02:00
2013-04-26 22:30:25 +02:00
2013-05-09 10:11:08 -07:00
2013-05-09 09:59:16 -07:00
2013-05-09 09:59:16 -07:00
2013-05-09 09:59:16 -07:00
2013-04-28 01:54:49 +02:00
2013-05-09 09:59:16 -07:00
2013-05-06 14:59:13 -07:00
2013-05-09 09:59:16 -07:00
2013-05-09 10:21:44 -07:00
2013-05-09 09:59:16 -07:00
2013-05-07 14:04:56 -07:00
2013-05-07 14:02:00 -07:00
2013-05-09 09:59:16 -07:00
2013-05-09 09:59:16 -07:00
2013-05-07 11:22:14 -07:00
2013-05-02 14:02:32 -07:00
2013-05-07 10:13:52 -07:00
2013-05-09 09:59:16 -07:00
2013-05-04 12:31:18 -07:00
2013-05-04 12:31:18 -07:00