rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Buffer overflow in the exitcode_proc_write function in arch/um/kernel/exitcode.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly have unspecified other impact by leveraging root privileges for a write operation.
Vulnerability ID: CVE-2013-4512
CWE: CWE-119
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-11-12
File: arch/um/kernel/exitcode.c
Commit message: uml: check length in exitcode_proc_write()

We don't cap the size of buffer from the user so we could write past the
end of the array here.  Only root can write to this file.

Reported-by: Nico Golde <nico@ngolde.de>
Reported-by: Fabian Yamaguchi <fabs@goesec.de>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Dan Carpenter

Vulnerable version (before fix):
 static ssize_t exitcode_proc_write(struct file *file, 		const char __user *buffer, size_t count, loff_t *pos) { 	char *end, buf[sizeof("nnnnn\0")]; 	int tmp;  	if (copy_from_user(buf, buffer, count)) 		return -EFAULT;  	tmp = simple_strtol(buf, &end, 0);

Fixed version (after fix):
 static ssize_t exitcode_proc_write(struct file *file, 		const char __user *buffer, size_t count, loff_t *pos) { 	char *end, buf[sizeof("nnnnn\0")]; 	size_t size; 	int tmp;  	size = min(count, sizeof(buf)); 	if (copy_from_user(buf, buffer, size)) 		return -EFAULT;  	tmp = simple_strtol(buf, &end, 0);

Patch:
patch: @@ -40,9 +40,11 @@ static ssize_t exitcode_proc_write(struct file *file,
 		const char __user *buffer, size_t count, loff_t *pos)
 {
 	char *end, buf[sizeof("nnnnn\0")];
+	size_t size;
 	int tmp;
 
-	if (copy_from_user(buf, buffer, count))
+	size = min(count, sizeof(buf));
+	if (copy_from_user(buf, buffer, size))
 		return -EFAULT;
 
 	tmp = simple_strtol(buf, &end, 0);
path: arch/um/kernel/exitcode.c
Vulnerability: Buffer overflow in the oz_cdev_write function in drivers/staging/ozwpan/ozcdev.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly have unspecified other impact via a crafted write operation.
Vulnerability ID: CVE-2013-4513
CWE: CWE-119
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-11-12
File: drivers/staging/ozwpan/ozcdev.c
Commit message: staging: ozwpan: prevent overflow in oz_cdev_write()

We need to check "count" so we don't overflow the ei->data buffer.

Reported-by: Nico Golde <nico@ngolde.de>
Reported-by: Fabian Yamaguchi <fabs@goesec.de>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Dan Carpenter

Vulnerable version (before fix):
 static ssize_t oz_cdev_write(struct file *filp, const char __user *buf, 	struct oz_app_hdr *app_hdr; 	struct oz_serial_ctx *ctx;  	spin_lock_bh(&g_cdev.lock); 	pd = g_cdev.active_pd; 	if (pd)

Fixed version (after fix):
 static ssize_t oz_cdev_write(struct file *filp, const char __user *buf, 	struct oz_app_hdr *app_hdr; 	struct oz_serial_ctx *ctx;  	if (count > sizeof(ei->data) - sizeof(*elt) - sizeof(*app_hdr)) 		return -EINVAL;  	spin_lock_bh(&g_cdev.lock); 	pd = g_cdev.active_pd; 	if (pd)

Patch:
patch: @@ -155,6 +155,9 @@ static ssize_t oz_cdev_write(struct file *filp, const char __user *buf,
 	struct oz_app_hdr *app_hdr;
 	struct oz_serial_ctx *ctx;
 
+	if (count > sizeof(ei->data) - sizeof(*elt) - sizeof(*app_hdr))
+		return -EINVAL;
+
 	spin_lock_bh(&g_cdev.lock);
 	pd = g_cdev.active_pd;
 	if (pd)
path: drivers/staging/ozwpan/ozcdev.c
Vulnerability: The bcm_char_ioctl function in drivers/staging/bcm/Bcmchar.c in the Linux kernel before 3.12 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via an IOCTL_BCM_GET_DEVICE_DRIVER_INFO ioctl call.
Vulnerability ID: CVE-2013-4515
CWE: CWE-200
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-11-12
File: drivers/staging/bcm/Bcmchar.c
Commit message: Staging: bcm: info leak in ioctl

The DevInfo.u32Reserved[] array isn't initialized so it leaks kernel
information to user space.

Reported-by: Nico Golde <nico@ngolde.de>
Reported-by: Fabian Yamaguchi <fabs@goesec.de>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Dan Carpenter

Vulnerable version (before fix):
 static long bcm_char_ioctl(struct file *filp, UINT cmd, ULONG arg)  		BCM_DEBUG_PRINT(Adapter, DBG_TYPE_OTHERS, OSAL_DBG, DBG_LVL_ALL, "Called IOCTL_BCM_GET_DEVICE_DRIVER_INFO\n");  		DevInfo.MaxRDMBufferSize = BUFFER_4K; 		DevInfo.u32DSDStartOffset = EEPROM_CALPARAM_START; 		DevInfo.u32RxAlignmentCorrection = 0;

Fixed version (after fix):
 static long bcm_char_ioctl(struct file *filp, UINT cmd, ULONG arg)  		BCM_DEBUG_PRINT(Adapter, DBG_TYPE_OTHERS, OSAL_DBG, DBG_LVL_ALL, "Called IOCTL_BCM_GET_DEVICE_DRIVER_INFO\n");  		memset(&DevInfo, 0, sizeof(DevInfo)); 		DevInfo.MaxRDMBufferSize = BUFFER_4K; 		DevInfo.u32DSDStartOffset = EEPROM_CALPARAM_START; 		DevInfo.u32RxAlignmentCorrection = 0;

Patch:
patch: @@ -1960,6 +1960,7 @@ static long bcm_char_ioctl(struct file *filp, UINT cmd, ULONG arg)
 
 		BCM_DEBUG_PRINT(Adapter, DBG_TYPE_OTHERS, OSAL_DBG, DBG_LVL_ALL, "Called IOCTL_BCM_GET_DEVICE_DRIVER_INFO\n");
 
+		memset(&DevInfo, 0, sizeof(DevInfo));
 		DevInfo.MaxRDMBufferSize = BUFFER_4K;
 		DevInfo.u32DSDStartOffset = EEPROM_CALPARAM_START;
 		DevInfo.u32RxAlignmentCorrection = 0;
path: drivers/staging/bcm/Bcmchar.c
Vulnerability: The mp_get_count function in drivers/staging/sb105x/sb_pci_mp.c in the Linux kernel before 3.12 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.
Vulnerability ID: CVE-2013-4516
CWE: CWE-200
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-11-12
File: drivers/staging/sb105x/sb_pci_mp.c
Commit message: Staging: sb105x: info leak in mp_get_count()

The icount.reserved[] array isn't initialized so it leaks stack
information to userspace.

Reported-by: Nico Golde <nico@ngolde.de>
Reported-by: Fabian Yamaguchi <fabs@goesec.de>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Dan Carpenter

Vulnerable version (before fix):
 static int mp_wait_modem_status(struct sb_uart_state *state, unsigned long arg)  static int mp_get_count(struct sb_uart_state *state, struct serial_icounter_struct *icnt) { 	struct serial_icounter_struct icount; 	struct sb_uart_icount cnow; 	struct sb_uart_port *port = state->port; 

Fixed version (after fix):
 static int mp_wait_modem_status(struct sb_uart_state *state, unsigned long arg)  static int mp_get_count(struct sb_uart_state *state, struct serial_icounter_struct *icnt) { 	struct serial_icounter_struct icount = {}; 	struct sb_uart_icount cnow; 	struct sb_uart_port *port = state->port; 

Patch:
patch: @@ -1063,7 +1063,7 @@ static int mp_wait_modem_status(struct sb_uart_state *state, unsigned long arg)
 
 static int mp_get_count(struct sb_uart_state *state, struct serial_icounter_struct *icnt)
 {
-	struct serial_icounter_struct icount;
+	struct serial_icounter_struct icount = {};
 	struct sb_uart_icount cnow;
 	struct sb_uart_port *port = state->port;
path: drivers/staging/sb105x/sb_pci_mp.c
Vulnerability: The udp6_ufo_fragment function in net/ipv6/udp_offload.c in the Linux kernel through 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly perform a certain size comparison before inserting a fragment header, which allows remote attackers to cause a denial of service (panic) via a large IPv6 UDP packet, as demonstrated by use of the Token Bucket Filter (TBF) queueing discipline.
Vulnerability ID: CVE-2013-4563
CWE: CWE-189
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-11-20
File: net/ipv6/udp_offload.c
Commit message: ipv6: fix headroom calculation in udp6_ufo_fragment

Commit 1e2bd517c108816220f262d7954b697af03b5f9c ("udp6: Fix udp
fragmentation for tunnel traffic.") changed the calculation if
there is enough space to include a fragment header in the skb from a
skb->mac_header dervived one to skb_headroom. Because we already peeled
off the skb to transport_header this is wrong. Change this back to check
if we have enough room before the mac_header.

This fixes a panic Saran Neti reported. He used the tbf scheduler which
skb_gso_segments the skb. The offsets get negative and we panic in memcpy
because the skb was erroneously not expanded at the head.

Reported-by: Saran Neti <Saran.Neti@telus.com>
Cc: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Hannes Frederic Sowa

Vulnerable version (before fix):
 static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,  		/* Check if there is enough headroom to insert fragment header. */ 		tnl_hlen = skb_tnl_header_len(skb); 		if (skb_headroom(skb) < (tnl_hlen + frag_hdr_sz)) { 			if (gso_pskb_expand_head(skb, tnl_hlen + frag_hdr_sz)) 				goto out; 		}

Fixed version (after fix):
 static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,  		/* Check if there is enough headroom to insert fragment header. */ 		tnl_hlen = skb_tnl_header_len(skb); 		if (skb->mac_header < (tnl_hlen + frag_hdr_sz)) { 			if (gso_pskb_expand_head(skb, tnl_hlen + frag_hdr_sz)) 				goto out; 		}

Patch:
patch: @@ -90,7 +90,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
 
 		/* Check if there is enough headroom to insert fragment header. */
 		tnl_hlen = skb_tnl_header_len(skb);
-		if (skb_headroom(skb) < (tnl_hlen + frag_hdr_sz)) {
+		if (skb->mac_header < (tnl_hlen + frag_hdr_sz)) {
 			if (gso_pskb_expand_head(skb, tnl_hlen + frag_hdr_sz))
 				goto out;
 		}
path: net/ipv6/udp_offload.c
Vulnerability: Array index error in the kvm_vm_ioctl_create_vcpu function in virt/kvm/kvm_main.c in the KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges via a large id value.
Vulnerability ID: CVE-2013-4587
CWE: CWE-20
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2013-12-14
File: virt/kvm/kvm_main.c
Commit message: KVM: Improve create VCPU parameter (CVE-2013-4587)

In multiple functions the vcpu_id is used as an offset into a bitfield.  Ag
malicious user could specify a vcpu_id greater than 255 in order to set or
clear bits in kernel memory.  This could be used to elevate priveges in the
kernel.  This patch verifies that the vcpu_id provided is less than 255.
The api documentation already specifies that the vcpu_id must be less than
max_vcpus, but this is currently not checked.

Reported-by: Andrew Honig <ahonig@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Andrew Honig <ahonig@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Commit author: Andy Honig

Vulnerable version (before fix):
 static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, u32 id) 	int r; 	struct kvm_vcpu *vcpu, *v;  	vcpu = kvm_arch_vcpu_create(kvm, id); 	if (IS_ERR(vcpu)) 		return PTR_ERR(vcpu);

Fixed version (after fix):
 static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, u32 id) 	int r; 	struct kvm_vcpu *vcpu, *v;  	if (id >= KVM_MAX_VCPUS) 		return -EINVAL;  	vcpu = kvm_arch_vcpu_create(kvm, id); 	if (IS_ERR(vcpu)) 		return PTR_ERR(vcpu);

Patch:
patch: @@ -1898,6 +1898,9 @@ static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, u32 id)
 	int r;
 	struct kvm_vcpu *vcpu, *v;
 
+	if (id >= KVM_MAX_VCPUS)
+		return -EINVAL;
+
 	vcpu = kvm_arch_vcpu_create(kvm, id);
 	if (IS_ERR(vcpu))
 		return PTR_ERR(vcpu);
path: virt/kvm/kvm_main.c
Vulnerability: Buffer overflow in the __nfs4_get_acl_uncached function in fs/nfs/nfs4proc.c in the Linux kernel before 3.7.2 allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via a getxattr system call for the system.nfs4_acl extended attribute of a pathname on an NFSv4 filesystem.
Vulnerability ID: CVE-2013-4591
CWE: CWE-119
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2013-11-20
File: fs/nfs/nfs4proc.c
Commit message: NFSv4: Check for buffer length in __nfs4_get_acl_uncached

Commit 1f1ea6c "NFSv4: Fix buffer overflow checking in
__nfs4_get_acl_uncached" accidently dropped the checking for too small
result buffer length.

If someone uses getxattr on "system.nfs4_acl" on an NFSv4 mount
supporting ACLs, the ACL has not been cached and the buffer suplied is
too short, we still copy the complete ACL, resulting in kernel and user
space memory corruption.

Signed-off-by: Sven Wegener <sven.wegener@stealer.net>
Cc: stable@kernel.org
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Commit author: Sven Wegener

Vulnerable version (before fix):
 static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu 		goto out_free; 	} 	nfs4_write_cached_acl(inode, pages, res.acl_data_offset, res.acl_len); 	if (buf) 		_copy_from_pages(buf, pages, res.acl_data_offset, res.acl_len); out_ok: 	ret = res.acl_len; out_free:

Fixed version (after fix):
 static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu 		goto out_free; 	} 	nfs4_write_cached_acl(inode, pages, res.acl_data_offset, res.acl_len); 	if (buf) { 		if (res.acl_len > buflen) { 			ret = -ERANGE; 			goto out_free; 		} 		_copy_from_pages(buf, pages, res.acl_data_offset, res.acl_len); 	} out_ok: 	ret = res.acl_len; out_free:

Patch:
patch: @@ -3937,8 +3937,13 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
 		goto out_free;
 	}
 	nfs4_write_cached_acl(inode, pages, res.acl_data_offset, res.acl_len);
-	if (buf)
+	if (buf) {
+		if (res.acl_len > buflen) {
+			ret = -ERANGE;
+			goto out_free;
+		}
 		_copy_from_pages(buf, pages, res.acl_data_offset, res.acl_len);
+	}
 out_ok:
 	ret = res.acl_len;
 out_free:
path: fs/nfs/nfs4proc.c
Vulnerability: SQL injection vulnerability in modules/rss/rss.php in Cotonti before 0.9.14 allows remote attackers to execute arbitrary SQL commands via the "c" parameter to index.php.
Vulnerability ID: CVE-2013-4789
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/Cotonti/Cotonti
Published: 2013-08-09
File: modules/rss/rss.php
Commit message: Fixed SQL injection vulnerability in RSS module
Commit author: Vladimir Sibirov

Vulnerable version (before fix):
 { 	require_once cot_incfile('page', 'module');  	if (!empty($c)) 	{ 		$mtch = $structure['page'][$c]['path']."."; 		$mtchlen = mb_strlen($mtch);

Fixed version (after fix):
 { 	require_once cot_incfile('page', 'module');  	if (!empty($c) && isset($structure['page'][$c])) 	{ 		$mtch = $structure['page'][$c]['path']."."; 		$mtchlen = mb_strlen($mtch);

Patch:
patch: @@ -199,7 +199,7 @@
 {
 	require_once cot_incfile('page', 'module');
 
-	if (!empty($c))
+	if (!empty($c) && isset($structure['page'][$c]))
 	{
 		$mtch = $structure['page'][$c]['path'].".";
 		$mtchlen = mb_strlen($mtch);
path: modules/rss/rss.php
Vulnerability: SQL injection vulnerability in core/inc/bigtree/cms.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to index.php.
Vulnerability ID: CVE-2013-4879
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/bigtreecms/BigTree-CMS
Published: 2013-08-14
File: core/inc/bigtree/cms.php
Commit message: Fixed error when putting ' in a URL by accident.
Commit author: Tim Buckingham

Vulnerable version (before fix):
 function checkOldRoutes($path) { 			$found = false; 			$x = count($path); 			while ($x) { 				$f = sqlfetch(sqlquery("SELECT * FROM bigtree_route_history WHERE old_route = '".implode("/",array_slice($path,0,$x))."'")); 				if ($f) { 					$old = $f["old_route"]; 					$new = $f["new_route"];

Fixed version (after fix):
 function checkOldRoutes($path) { 			$found = false; 			$x = count($path); 			while ($x) { 				$f = sqlfetch(sqlquery("SELECT * FROM bigtree_route_history WHERE old_route = '".sqlescape(implode("/",array_slice($path,0,$x)))."'")); 				if ($f) { 					$old = $f["old_route"]; 					$new = $f["new_route"];

Patch:
patch: @@ -127,7 +127,7 @@ function checkOldRoutes($path) {
 			$found = false;
 			$x = count($path);
 			while ($x) {
-				$f = sqlfetch(sqlquery("SELECT * FROM bigtree_route_history WHERE old_route = '".implode("/",array_slice($path,0,$x))."'"));
+				$f = sqlfetch(sqlquery("SELECT * FROM bigtree_route_history WHERE old_route = '".sqlescape(implode("/",array_slice($path,0,$x)))."'"));
 				if ($f) {
 					$old = $f["old_route"];
 					$new = $f["new_route"];
path: core/inc/bigtree/cms.php
Vulnerability: Cross-site scripting (XSS) vulnerability in core/admin/modules/developer/modules/views/add.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to inject arbitrary web script or HTML via the module parameter.
Vulnerability ID: CVE-2013-4880
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/bigtreecms/BigTree-CMS
Published: 2013-08-14
File: core/admin/modules/developer/modules/views/add.php
Commit message: Fixed a potential cross-site scripting issue on the module view add page.
Thanks to High-Tech Bridge Security Research Lab for finding this and the Cross-Site Request Forgery issues.
Commit author: Tim Buckingham

Vulnerable version (before fix):
 <? 	$id = $_GET["module"]; 	$table = isset($_GET["table"]) ? $_GET["table"] : ""; 	$title = isset($_GET["title"]) ? htmlspecialchars($_GET["title"]) : ""; 	

Fixed version (after fix):
 <? 	$id = htmlspecialchars($_GET["module"]); 	$table = isset($_GET["table"]) ? $_GET["table"] : ""; 	$title = isset($_GET["title"]) ? htmlspecialchars($_GET["title"]) : ""; 	

Patch:
patch: @@ -1,5 +1,5 @@
 <?
-	$id = $_GET["module"];
+	$id = htmlspecialchars($_GET["module"]);
 	$table = isset($_GET["table"]) ? $_GET["table"] : "";
 	$title = isset($_GET["title"]) ? htmlspecialchars($_GET["title"]) : "";
path: core/admin/modules/developer/modules/views/add.php
Vulnerability: The apic_get_tmcct function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a denial of service (divide-by-zero error and host OS crash) via crafted modifications of the TMICT value.
Vulnerability ID: CVE-2013-6367
CWE: CWE-189
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-12-14
File: arch/x86/kvm/lapic.c
Commit message: KVM: x86: Fix potential divide by 0 in lapic (CVE-2013-6367)

Under guest controllable circumstances apic_get_tmcct will execute a
divide by zero and cause a crash.  If the guest cpuid support
tsc deadline timers and performs the following sequence of requests
the host will crash.
- Set the mode to periodic
- Set the TMICT to 0
- Set the mode bits to 11 (neither periodic, nor one shot, nor tsc deadline)
- Set the TMICT to non-zero.
Then the lapic_timer.period will be 0, but the TMICT will not be.  If the
guest then reads from the TMCCT then the host will perform a divide by 0.

This patch ensures that if the lapic_timer.period is 0, then the division
does not occur.

Reported-by: Andrew Honig <ahonig@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Andrew Honig <ahonig@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Commit author: Andy Honig

Vulnerable version (before fix):
 static u32 apic_get_tmcct(struct kvm_lapic *apic) 	ASSERT(apic != NULL);  	/* if initial count is 0, current count should also be 0 */ 	if (kvm_apic_get_reg(apic, APIC_TMICT) == 0) 		return 0;  	remaining = hrtimer_get_remaining(&apic->lapic_timer.timer);

Fixed version (after fix):
 static u32 apic_get_tmcct(struct kvm_lapic *apic) 	ASSERT(apic != NULL);  	/* if initial count is 0, current count should also be 0 */ 	if (kvm_apic_get_reg(apic, APIC_TMICT) == 0 || 		apic->lapic_timer.period == 0) 		return 0;  	remaining = hrtimer_get_remaining(&apic->lapic_timer.timer);

Patch:
patch: @@ -841,7 +841,8 @@ static u32 apic_get_tmcct(struct kvm_lapic *apic)
 	ASSERT(apic != NULL);
 
 	/* if initial count is 0, current count should also be 0 */
-	if (kvm_apic_get_reg(apic, APIC_TMICT) == 0)
+	if (kvm_apic_get_reg(apic, APIC_TMICT) == 0 ||
+		apic->lapic_timer.period == 0)
 		return 0;
 
 	remaining = hrtimer_get_remaining(&apic->lapic_timer.timer);
path: arch/x86/kvm/lapic.c
Vulnerability: The lbs_debugfs_write function in drivers/net/wireless/libertas/debugfs.c in the Linux kernel through 3.12.1 allows local users to cause a denial of service (OOPS) by leveraging root privileges for a zero-length write operation.
Vulnerability ID: CVE-2013-6378
CWE: CWE-189
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-11-27
File: drivers/net/wireless/libertas/debugfs.c
Commit message: libertas: potential oops in debugfs

If we do a zero size allocation then it will oops.  Also we can't be
sure the user passes us a NUL terminated string so I've added a
terminator.

This code can only be triggered by root.

Reported-by: Nico Golde <nico@ngolde.de>
Reported-by: Fabian Yamaguchi <fabs@goesec.de>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Commit author: Dan Carpenter

Vulnerable version (before fix):
 static ssize_t lbs_debugfs_write(struct file *f, const char __user *buf, 	char *p2; 	struct debug_data *d = f->private_data;  	pdata = kmalloc(cnt, GFP_KERNEL); 	if (pdata == NULL) 		return 0;  static ssize_t lbs_debugfs_write(struct file *f, const char __user *buf, 		kfree(pdata); 		return 0; 	}  	p0 = pdata; 	for (i = 0; i < num_of_items; i++) {

Fixed version (after fix):
 static ssize_t lbs_debugfs_write(struct file *f, const char __user *buf, 	char *p2; 	struct debug_data *d = f->private_data;  	if (cnt == 0) 		return 0;  	pdata = kmalloc(cnt + 1, GFP_KERNEL); 	if (pdata == NULL) 		return 0;  static ssize_t lbs_debugfs_write(struct file *f, const char __user *buf, 		kfree(pdata); 		return 0; 	} 	pdata[cnt] = '\0';  	p0 = pdata; 	for (i = 0; i < num_of_items; i++) {

Patch:
patch: @@ -913,7 +913,10 @@ static ssize_t lbs_debugfs_write(struct file *f, const char __user *buf,
 	char *p2;
 	struct debug_data *d = f->private_data;
 
-	pdata = kmalloc(cnt, GFP_KERNEL);
+	if (cnt == 0)
+		return 0;
+
+	pdata = kmalloc(cnt + 1, GFP_KERNEL);
 	if (pdata == NULL)
 		return 0;
 
@@ -922,6 +925,7 @@ static ssize_t lbs_debugfs_write(struct file *f, const char __user *buf,
 		kfree(pdata);
 		return 0;
 	}
+	pdata[cnt] = '\0';
 
 	p0 = pdata;
 	for (i = 0; i < num_of_items; i++) {
path: drivers/net/wireless/libertas/debugfs.c