Off-by-one error in the options_write function in drivers/misc/sgi-gru/gruprocfs.c in the SGI GRU driver in the Linux kernel 2.6.30.2 and earlier on ia64 and x86 platforms might allow local users to overwrite arbitrary memory locations and gain privileges via a crafted count argument, which triggers a stack-based buffer overflow.
Weaknesses in this category are related to improper calculation or conversion of numbers.
Link | Tags |
---|---|
http://lkml.org/lkml/2009/7/20/362 | third party advisory mailing list |
http://www.ubuntu.com/usn/USN-852-1 | third party advisory vendor advisory |
http://lkml.org/lkml/2009/7/20/348 | mailing list exploit third party advisory |
http://grsecurity.net/~spender/exploit_demo.c | third party advisory exploit |
https://exchange.xforce.ibmcloud.com/vulnerabilities/51887 | vdb entry third party advisory |
http://www.securityfocus.com/bid/35753 | vdb entry third party advisory |
http://secunia.com/advisories/37105 | third party advisory |
http://xorl.wordpress.com/2009/07/21/linux-kernel-sgi-gru-driver-off-by-one-overwrite/ | third party advisory exploit |