Kees Cook e0e29b683d b43: stop format string leaking into error msgs
The module parameter "fwpostfix" is userspace controllable, unfiltered,
and is used to define the firmware filename. b43_do_request_fw() populates
ctx->errors[] on error, containing the firmware filename. b43err()
parses its arguments as a format string. For systems with b43 hardware,
this could lead to a uid-0 to ring-0 escalation.

CVE-2013-2852

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-06-12 10:20:59 -04:00
..
2013-05-09 09:59:16 -07:00
2013-03-28 01:20:42 -04:00
2013-03-26 12:27:18 -04:00
2013-04-29 15:27:47 -04:00