rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: fs/namespace.c in the Linux kernel before 4.0.2 does not properly support mount connectivity, which allows local users to read arbitrary files by leveraging user-namespace root access for deletion of a file or directory.
Vulnerability ID: CVE-2015-4176
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2016-05-02
File: fs/namespace.c
Commit message: mnt: Update detach_mounts to leave mounts connected

Now that it is possible to lazily unmount an entire mount tree and
leave the individual mounts connected to each other add a new flag
UMOUNT_CONNECTED to umount_tree to force this behavior and use
this flag in detach_mounts.

This closes a bug where the deletion of a file or directory could
trigger an unmount and reveal data under a mount point.

Cc: stable@vger.kernel.org
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Commit author: Eric W. Biederman

Vulnerable version (before fix):
 static inline void namespace_lock(void) enum umount_tree_flags { 	UMOUNT_SYNC = 1, 	UMOUNT_PROPAGATE = 2, }; /*  * mount_lock must be held static void umount_tree(struct mount *mnt, enum umount_tree_flags how) 		if (how & UMOUNT_SYNC) 			p->mnt.mnt_flags |= MNT_SYNC_UMOUNT;  		disconnect = !IS_MNT_LOCKED_AND_LAZY(p);  		pin_insert_group(&p->mnt_umount, &p->mnt_parent->mnt, 				 disconnect ? &unmounted : NULL); void __detach_mounts(struct dentry *dentry) 				umount_mnt(p); 			} 		} 		else umount_tree(mnt, 0); 	} 	unlock_mount_hash(); 	put_mountpoint(mp);

Fixed version (after fix):
 static inline void namespace_lock(void) enum umount_tree_flags { 	UMOUNT_SYNC = 1, 	UMOUNT_PROPAGATE = 2, 	UMOUNT_CONNECTED = 4, }; /*  * mount_lock must be held static void umount_tree(struct mount *mnt, enum umount_tree_flags how) 		if (how & UMOUNT_SYNC) 			p->mnt.mnt_flags |= MNT_SYNC_UMOUNT;  		disconnect = !(((how & UMOUNT_CONNECTED) && 				mnt_has_parent(p) && 				(p->mnt_parent->mnt.mnt_flags & MNT_UMOUNT)) || 			       IS_MNT_LOCKED_AND_LAZY(p));  		pin_insert_group(&p->mnt_umount, &p->mnt_parent->mnt, 				 disconnect ? &unmounted : NULL); void __detach_mounts(struct dentry *dentry) 				umount_mnt(p); 			} 		} 		else umount_tree(mnt, UMOUNT_CONNECTED); 	} 	unlock_mount_hash(); 	put_mountpoint(mp);

Patch:
patch: @@ -1348,6 +1348,7 @@ static inline void namespace_lock(void)
 enum umount_tree_flags {
 	UMOUNT_SYNC = 1,
 	UMOUNT_PROPAGATE = 2,
+	UMOUNT_CONNECTED = 4,
 };
 /*
  * mount_lock must be held
@@ -1386,7 +1387,10 @@ static void umount_tree(struct mount *mnt, enum umount_tree_flags how)
 		if (how & UMOUNT_SYNC)
 			p->mnt.mnt_flags |= MNT_SYNC_UMOUNT;
 
-		disconnect = !IS_MNT_LOCKED_AND_LAZY(p);
+		disconnect = !(((how & UMOUNT_CONNECTED) &&
+				mnt_has_parent(p) &&
+				(p->mnt_parent->mnt.mnt_flags & MNT_UMOUNT)) ||
+			       IS_MNT_LOCKED_AND_LAZY(p));
 
 		pin_insert_group(&p->mnt_umount, &p->mnt_parent->mnt,
 				 disconnect ? &unmounted : NULL);
@@ -1529,7 +1533,7 @@ void __detach_mounts(struct dentry *dentry)
 				umount_mnt(p);
 			}
 		}
-		else umount_tree(mnt, 0);
+		else umount_tree(mnt, UMOUNT_CONNECTED);
 	}
 	unlock_mount_hash();
 	put_mountpoint(mp);
path: fs/namespace.c
Vulnerability: Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a .. (dot dot) in the dir parameter to admin/asset/add-asset-compatibility.
Vulnerability ID: CVE-2015-4425
CWE: CWE-22
Severity score: 4.9
Project: https://github.com/pimcore/pimcore
Published: 2015-08-18
File: pimcore/modules/admin/controllers/AssetController.php
Commit message: AssetController: directory traversal vulnerability issue

git-svn-id: http://www.pimcore.org/svn/pimcore/private/core/trunk@6458 1f8fe7d8-47f0-464c-8d0a-336f4953ab05
Commit author: memleak

Vulnerable version (before fix):
 protected function addAsset()             $parent = Asset::getById($this->getParam("parentId"));             $newPath = $parent->getFullPath() . "/" . trim($this->getParam("dir"), "/ ");              $maxRetries = 5;             for ($retries=0; $retries<$maxRetries; $retries++) {                 try {

Fixed version (after fix):
 protected function addAsset()             $parent = Asset::getById($this->getParam("parentId"));             $newPath = $parent->getFullPath() . "/" . trim($this->getParam("dir"), "/ ");              // check if the path is outside of the asset directory             $newRealPath = PIMCORE_ASSET_DIRECTORY . $newPath;             $newRealPath= realpath($newRealPath);             if (strpos($newRealPath, PIMCORE_ASSET_DIRECTORY) !== 0) {                 throw new Exception("not allowed");             }              $maxRetries = 5;             for ($retries=0; $retries<$maxRetries; $retries++) {                 try {

Patch:
patch: @@ -210,6 +210,13 @@ protected function addAsset()
             $parent = Asset::getById($this->getParam("parentId"));
             $newPath = $parent->getFullPath() . "/" . trim($this->getParam("dir"), "/ ");
 
+            // check if the path is outside of the asset directory
+            $newRealPath = PIMCORE_ASSET_DIRECTORY . $newPath;
+            $newRealPath= realpath($newRealPath);
+            if (strpos($newRealPath, PIMCORE_ASSET_DIRECTORY) !== 0) {
+                throw new Exception("not allowed");
+            }
+
             $maxRetries = 5;
             for ($retries=0; $retries<$maxRetries; $retries++) {
                 try {
path: pimcore/modules/admin/controllers/AssetController.php
Vulnerability: SQL injection vulnerability in pimcore before build 3473 allows remote attackers to execute arbitrary SQL commands via the filter parameter to admin/asset/grid-proxy.
Vulnerability ID: CVE-2015-4426
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/pimcore/pimcore
Published: 2015-08-18
File: pimcore/modules/admin/controllers/AssetController.php
Commit message: fixed sql injection issue

git-svn-id: http://www.pimcore.org/svn/pimcore/private/core/trunk@6460 1f8fe7d8-47f0-464c-8d0a-336f4953ab05
Commit author: memleak

Vulnerable version (before fix):
 public function gridProxyAction() {                 //TODO probably not needed             }         } else {             // get list of objects             $folder = Asset::getById($this->getParam("folderId"));   public function gridProxyAction() {                         $field = "CONCAT(path,filename)";                     }                      $conditionFilters[] =  $field . $operator . " '" . $value . "' ";                 }             } 

Fixed version (after fix):
 public function gridProxyAction() {                 //TODO probably not needed             }         } else {             $db = \Pimcore\Resource::get();                 // get list of objects             $folder = Asset::getById($this->getParam("folderId"));   public function gridProxyAction() {                         $field = "CONCAT(path,filename)";                     }                      $conditionFilters[] =  $field . $operator . " " . $db->quote($value);                 }             } 

Patch:
patch: @@ -1584,7 +1584,8 @@ public function gridProxyAction() {
                 //TODO probably not needed
             }
         } else {
-            // get list of objects
+            $db = \Pimcore\Resource::get();
+                // get list of objects
             $folder = Asset::getById($this->getParam("folderId"));
 
 
@@ -1665,7 +1666,7 @@ public function gridProxyAction() {
                         $field = "CONCAT(path,filename)";
                     }
 
-                    $conditionFilters[] =  $field . $operator . " '" . $value . "' ";
+                    $conditionFilters[] =  $field . $operator . " " . $db->quote($value);
                 }
             }
path: pimcore/modules/admin/controllers/AssetController.php
Vulnerability: SQL injection vulnerability in the insert function in application/controllers/admin/dataentry.php in LimeSurvey 2.06+ allows remote authenticated users to execute arbitrary SQL commands via the closedate parameter.
Vulnerability ID: CVE-2015-5078
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/LimeSurvey/LimeSurvey
Published: 2015-06-28
File: application/controllers/admin/dataentry.php
Commit message: Fixed issue #9720: SQL injection vulnerability in data entry
Commit author: Carsten Schmitz

Vulnerable version (before fix):
 public function insert()                         {                             if (isset($usesleft) && $usesleft<=1)                             {                                 $utquery .= "SET usesleft=usesleft-1, completed='$submitdate'\n";                             }                             else                             {

Fixed version (after fix):
 public function insert()                         {                             if (isset($usesleft) && $usesleft<=1)                             {                                 $utquery .= "SET usesleft=usesleft-1, completed=".dbQuoteAll($submitdate);                             }                             else                             {

Patch:
patch: @@ -1716,7 +1716,7 @@ public function insert()
                         {
                             if (isset($usesleft) && $usesleft<=1)
                             {
-                                $utquery .= "SET usesleft=usesleft-1, completed='$submitdate'\n";
+                                $utquery .= "SET usesleft=usesleft-1, completed=".dbQuoteAll($submitdate);
                             }
                             else
                             {
path: application/controllers/admin/dataentry.php
Vulnerability: The virtnet_probe function in drivers/net/virtio_net.c in the Linux kernel before 4.2 attempts to support a FRAGLIST feature without proper memory allocation, which allows guest OS users to cause a denial of service (buffer overflow and memory corruption) via a crafted sequence of fragmented packets.
Vulnerability ID: CVE-2015-5156
CWE: CWE-119
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2015-10-19
File: drivers/net/virtio_net.c
Commit message: virtio-net: drop NETIF_F_FRAGLIST

virtio declares support for NETIF_F_FRAGLIST, but assumes
that there are at most MAX_SKB_FRAGS + 2 fragments which isn't
always true with a fraglist.

A longer fraglist in the skb will make the call to skb_to_sgvec overflow
the sg array, leading to memory corruption.

Drop NETIF_F_FRAGLIST so we only get what we can handle.

Cc: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Jason Wang

Vulnerable version (before fix):
 static int virtnet_probe(struct virtio_device *vdev) 	/* Do we support "hardware" checksums? */ 	if (virtio_has_feature(vdev, VIRTIO_NET_F_CSUM)) { 		/* This opens up the world of extra features. */ 		dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST; 		if (csum) 			dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;  		if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) { 			dev->hw_features |= NETIF_F_TSO | NETIF_F_UFO

Fixed version (after fix):
 static int virtnet_probe(struct virtio_device *vdev) 	/* Do we support "hardware" checksums? */ 	if (virtio_has_feature(vdev, VIRTIO_NET_F_CSUM)) { 		/* This opens up the world of extra features. */ 		dev->hw_features |= NETIF_F_HW_CSUM | NETIF_F_SG; 		if (csum) 			dev->features |= NETIF_F_HW_CSUM | NETIF_F_SG;  		if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) { 			dev->hw_features |= NETIF_F_TSO | NETIF_F_UFO

Patch:
patch: @@ -1756,9 +1756,9 @@ static int virtnet_probe(struct virtio_device *vdev)
 	/* Do we support "hardware" checksums? */
 	if (virtio_has_feature(vdev, VIRTIO_NET_F_CSUM)) {
 		/* This opens up the world of extra features. */
-		dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
+		dev->hw_features |= NETIF_F_HW_CSUM | NETIF_F_SG;
 		if (csum)
-			dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
+			dev->features |= NETIF_F_HW_CSUM | NETIF_F_SG;
 
 		if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) {
 			dev->hw_features |= NETIF_F_TSO | NETIF_F_UFO
path: drivers/net/virtio_net.c
Vulnerability: Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.
Vulnerability ID: CVE-2015-5221
CWE: CWE-416
Severity score: 2.9
Project: https://github.com/mdadams/jasper
Published: 2017-07-25
File: src/libjasper/mif/mif_cod.c
Commit message: CVE-2015-5221
Commit author: Richard Hughes

Vulnerable version (before fix):
 static int mif_process_cmpt(mif_hdr_t *hdr, char *buf) 			break; 		} 	} 	jas_tvparser_destroy(tvp); 	if (!cmpt->sampperx || !cmpt->samppery) { 		goto error; 	} 	if (mif_hdr_addcmpt(hdr, hdr->numcmpts, cmpt)) { 		goto error; 	} 	return 0;  error:

Fixed version (after fix):
 static int mif_process_cmpt(mif_hdr_t *hdr, char *buf) 			break; 		} 	} 	if (!cmpt->sampperx || !cmpt->samppery) { 		goto error; 	} 	if (mif_hdr_addcmpt(hdr, hdr->numcmpts, cmpt)) { 		goto error; 	} 	jas_tvparser_destroy(tvp); 	return 0;  error:

Patch:
patch: @@ -570,13 +570,13 @@ static int mif_process_cmpt(mif_hdr_t *hdr, char *buf)
 			break;
 		}
 	}
-	jas_tvparser_destroy(tvp);
 	if (!cmpt->sampperx || !cmpt->samppery) {
 		goto error;
 	}
 	if (mif_hdr_addcmpt(hdr, hdr->numcmpts, cmpt)) {
 		goto error;
 	}
+	jas_tvparser_destroy(tvp);
 	return 0;
 
 error:
path: src/libjasper/mif/mif_cod.c
Vulnerability: Cross-site scripting (XSS) vulnerability in admin/filebrowser.php in GetSimple CMS before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the func parameter.
Vulnerability ID: CVE-2015-5356
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/GetSimpleCMS/GetSimpleCMS
Published: 2015-07-01
File: admin/filebrowser.php
Commit message: fix #1059
Commit author: Shawn A

Vulnerable version (before fix):
 $subPath = (isset($_GET['path'])) ? $_GET['path'] : ""; if(!path_is_safe($path,GSDATAUPLOADPATH)) die(); $returnid = isset($_GET['returnid']) ? var_out($_GET['returnid']) : ""; $func = (isset($_GET['func'])) ? $_GET['func'] : ""; $path = tsl($path); // check if host uses Linux (used for displaying permissions $isUnixHost = (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN' ? false : true); function submitLink($funcNum, $url) {             }         <?php  			if (isset($_GET['func'])){ 			$func = @$_GET['func']; 		?> 				if(window.opener){ 					if(typeof window.opener.<?php echo $func; ?> == 'function') {

Fixed version (after fix):
 $subPath = (isset($_GET['path'])) ? $_GET['path'] : ""; if(!path_is_safe($path,GSDATAUPLOADPATH)) die(); $returnid = isset($_GET['returnid']) ? var_out($_GET['returnid']) : ""; $func = (isset($_GET['func'])) ? var_out($_GET['func']) : ""; $path = tsl($path); // check if host uses Linux (used for displaying permissions $isUnixHost = (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN' ? false : true); function submitLink($funcNum, $url) {             }         <?php  			if (isset($_GET['func'])){ 		?> 				if(window.opener){ 					if(typeof window.opener.<?php echo $func; ?> == 'function') {

Patch:
patch: @@ -20,7 +20,7 @@
 $subPath = (isset($_GET['path'])) ? $_GET['path'] : "";
 if(!path_is_safe($path,GSDATAUPLOADPATH)) die();
 $returnid = isset($_GET['returnid']) ? var_out($_GET['returnid']) : "";
-$func = (isset($_GET['func'])) ? $_GET['func'] : "";
+$func = (isset($_GET['func'])) ? var_out($_GET['func']) : "";
 $path = tsl($path);
 // check if host uses Linux (used for displaying permissions
 $isUnixHost = (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN' ? false : true);
@@ -52,7 +52,6 @@ function submitLink($funcNum, $url) {
             }
         <?php 
 			if (isset($_GET['func'])){
-			$func = @$_GET['func'];
 		?>
 				if(window.opener){
 					if(typeof window.opener.<?php echo $func; ?> == 'function') {
path: admin/filebrowser.php
Vulnerability: eventapp/lib/gcloud.rb in the ISUCON5 qualifier portal (aka eventapp) web application before 2015-10-30 makes improper popen calls, which allows remote attackers to execute arbitrary commands via an HTTP request that includes shell metacharacters in an argument to a "gcloud compute" command.
Vulnerability ID: CVE-2015-5673
CWE: CWE-78
Severity score: 6.4
Project: https://github.com/isucon/isucon5-qualify
Published: 2015-11-04
File: eventapp/lib/gcloud.rb
Commit message: Merge pull request #5 from sorah/osci

eventapp: Use array to pass arguments
Commit author: sorah Shota Fukumori

Vulnerable version (before fix):
 def self.valid_ip_address(project_id, zone_name, instance_name)   end    def self.server_info(project_id, zone_name, instance_name)     jsonText = IO.popen("gcloud compute --project #{project_id} instances list --zones #{zone_name} --format json") do |io|       io.read()     end     serverInfoList = JSON.parse(jsonText) rescue nil

Fixed version (after fix):
 def self.valid_ip_address(project_id, zone_name, instance_name)   end    def self.server_info(project_id, zone_name, instance_name)     jsonText = IO.popen([*%w(gcloud compute --project), project_id, %w(instances list --zones), zone_name, %w(--format json)]) do |io|       io.read()     end     serverInfoList = JSON.parse(jsonText) rescue nil

Patch:
patch: @@ -13,7 +13,7 @@ def self.valid_ip_address(project_id, zone_name, instance_name)
   end
 
   def self.server_info(project_id, zone_name, instance_name)
-    jsonText = IO.popen("gcloud compute --project #{project_id} instances list --zones #{zone_name} --format json") do |io|
+    jsonText = IO.popen([*%w(gcloud compute --project), project_id, %w(instances list --zones), zone_name, %w(--format json)]) do |io|
       io.read()
     end
     serverInfoList = JSON.parse(jsonText) rescue nil
path: eventapp/lib/gcloud.rb
Vulnerability: The lazy_bdecode function in BitTorrent DHT bootstrap server (bootstrap-dht ) allows remote attackers to execute arbitrary code via a crafted packet, related to "improper indexing."
Vulnerability ID: CVE-2015-5685
CWE: CWE-20
Severity score: 6.4
Project: https://github.com/bittorrent/bootstrap-dht
Published: 2015-08-13
File: lazy_bdecode.cpp
Commit message: Check for out-of-bounds bencoded lengths before advancing buffer pointer
Commit author: xercesblue

Vulnerable version (before fix):
 namespace libtorrent 					if (e) 						TORRENT_FAIL_BDECODE(e);  					if (start + len + 1 > end) 						TORRENT_FAIL_BDECODE(bdecode_errors::unexpected_eof);  					if (len < 0) namespace libtorrent 					start = parse_int(start, end, ':', len, e); 					if (e) 						TORRENT_FAIL_BDECODE(e); 					if (start + len + 1 > end) 						TORRENT_FAIL_BDECODE(bdecode_errors::unexpected_eof); 					if (len < 0) 						TORRENT_FAIL_BDECODE(bdecode_errors::overflow);  					++start; 					top->construct_string(start, int(len)); 					stack.pop_back(); 					start += len;

Fixed version (after fix):
 namespace libtorrent 					if (e) 						TORRENT_FAIL_BDECODE(e);  					// remaining buffer size excluding ':' 					const ptrdiff_t buff_size = end - start - 1; 					if (len > buff_size) 						TORRENT_FAIL_BDECODE(bdecode_errors::unexpected_eof);  					if (len < 0) namespace libtorrent 					start = parse_int(start, end, ':', len, e); 					if (e) 						TORRENT_FAIL_BDECODE(e);  					// remaining buffer size excluding ':' 					const ptrdiff_t buff_size = end - start - 1; 					if (len > buff_size) 						TORRENT_FAIL_BDECODE(bdecode_errors::unexpected_eof); 					if (len < 0) 						TORRENT_FAIL_BDECODE(bdecode_errors::overflow);  					++start; 					if (start == end) TORRENT_FAIL_BDECODE(bdecode_errors::unexpected_eof); 					top->construct_string(start, int(len)); 					stack.pop_back(); 					start += len;

Patch:
patch: @@ -150,7 +150,9 @@ namespace libtorrent
 					if (e)
 						TORRENT_FAIL_BDECODE(e);
 
-					if (start + len + 1 > end)
+					// remaining buffer size excluding ':'
+					const ptrdiff_t buff_size = end - start - 1;
+					if (len > buff_size)
 						TORRENT_FAIL_BDECODE(bdecode_errors::unexpected_eof);
 
 					if (len < 0)
@@ -216,12 +218,16 @@ namespace libtorrent
 					start = parse_int(start, end, ':', len, e);
 					if (e)
 						TORRENT_FAIL_BDECODE(e);
-					if (start + len + 1 > end)
+
+					// remaining buffer size excluding ':'
+					const ptrdiff_t buff_size = end - start - 1;
+					if (len > buff_size)
 						TORRENT_FAIL_BDECODE(bdecode_errors::unexpected_eof);
 					if (len < 0)
 						TORRENT_FAIL_BDECODE(bdecode_errors::overflow);
 
 					++start;
+					if (start == end) TORRENT_FAIL_BDECODE(bdecode_errors::unexpected_eof);
 					top->construct_string(start, int(len));
 					stack.pop_back();
 					start += len;
path: lazy_bdecode.cpp
Vulnerability: The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a certain bitmap data structure, which allows local users to obtain sensitive information from kernel memory via a GET_BITMAP_FILE ioctl call.
Vulnerability ID: CVE-2015-5697
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2015-08-31
File: drivers/md/md.c
Commit message: md: use kzalloc() when bitmap is disabled

In drivers/md/md.c get_bitmap_file() uses kmalloc() for creating a
mdu_bitmap_file_t called "file".

5769         file = kmalloc(sizeof(*file), GFP_NOIO);
5770         if (!file)
5771                 return -ENOMEM;

This structure is copied to user space at the end of the function.

5786         if (err == 0 &&
5787             copy_to_user(arg, file, sizeof(*file)))
5788                 err = -EFAULT

But if bitmap is disabled only the first byte of "file" is initialized
with zero, so it's possible to read some bytes (up to 4095) of kernel
space memory from user space. This is an information leak.

5775         /* bitmap disabled, zero the first byte and copy out */
5776         if (!mddev->bitmap_info.file)
5777                 file->pathname[0] = '\0';

Signed-off-by: Benjamin Randazzo <benjamin@randazzo.fr>
Signed-off-by: NeilBrown <neilb@suse.com>
Commit author: Benjamin Randazzo

Vulnerable version (before fix):
 static int get_bitmap_file(struct mddev *mddev, void __user * arg) 	char *ptr; 	int err;  	file = kmalloc(sizeof(*file), GFP_NOIO); 	if (!file) 		return -ENOMEM; 

Fixed version (after fix):
 static int get_bitmap_file(struct mddev *mddev, void __user * arg) 	char *ptr; 	int err;  	file = kzalloc(sizeof(*file), GFP_NOIO); 	if (!file) 		return -ENOMEM; 

Patch:
patch: @@ -5759,7 +5759,7 @@ static int get_bitmap_file(struct mddev *mddev, void __user * arg)
 	char *ptr;
 	int err;
 
-	file = kmalloc(sizeof(*file), GFP_NOIO);
+	file = kzalloc(sizeof(*file), GFP_NOIO);
 	if (!file)
 		return -ENOMEM;
path: drivers/md/md.c