rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The do_ip_vs_get_ctl function in net/netfilter/ipvs/ip_vs_ctl.c in the Linux kernel before 3.6 does not initialize a certain structure for IP_VS_SO_GET_TIMEOUT commands, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
Vulnerability ID: CVE-2012-6540
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2013-03-15
File: net/netfilter/ipvs/ip_vs_ctl.c
Commit message: ipvs: fix info leak in getsockopt(IP_VS_SO_GET_TIMEOUT)

If at least one of CONFIG_IP_VS_PROTO_TCP or CONFIG_IP_VS_PROTO_UDP is
not set, __ip_vs_get_timeouts() does not fully initialize the structure
that gets copied to userland and that for leaks up to 12 bytes of kernel
stack. Add an explicit memset(0) before passing the structure to
__ip_vs_get_timeouts() to avoid the info leak.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Wensong Zhang <wensong@linux-vs.org>
Cc: Simon Horman <horms@verge.net.au>
Cc: Julian Anastasov <ja@ssi.bg>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mathias Krause

Vulnerable version (before fix):
 do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len) 	{ 		struct ip_vs_timeout_user t;  		__ip_vs_get_timeouts(net, &t); 		if (copy_to_user(user, &t, sizeof(t)) != 0) 			ret = -EFAULT;

Fixed version (after fix):
 do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len) 	{ 		struct ip_vs_timeout_user t;  		memset(&t, 0, sizeof(t)); 		__ip_vs_get_timeouts(net, &t); 		if (copy_to_user(user, &t, sizeof(t)) != 0) 			ret = -EFAULT;

Patch:
patch: @@ -2759,6 +2759,7 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
 	{
 		struct ip_vs_timeout_user t;
 
+		memset(&t, 0, sizeof(t));
 		__ip_vs_get_timeouts(net, &t);
 		if (copy_to_user(user, &t, sizeof(t)) != 0)
 			ret = -EFAULT;
path: net/netfilter/ipvs/ip_vs_ctl.c
Vulnerability: The ccid3_hc_tx_getsockopt function in net/dccp/ccids/ccid3.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
Vulnerability ID: CVE-2012-6541
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2013-03-15
File: net/dccp/ccids/ccid3.c
Commit message: dccp: fix info leak via getsockopt(DCCP_SOCKOPT_CCID_TX_INFO)

The CCID3 code fails to initialize the trailing padding bytes of struct
tfrc_tx_info added for alignment on 64 bit architectures. It that for
potentially leaks four bytes kernel stack via the getsockopt() syscall.
Add an explicit memset(0) before filling the structure to avoid the
info leak.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mathias Krause

Vulnerable version (before fix):
 static int ccid3_hc_tx_getsockopt(struct sock *sk, const int optname, int len, 	case DCCP_SOCKOPT_CCID_TX_INFO: 		if (len < sizeof(tfrc)) 			return -EINVAL; 		tfrc.tfrctx_x	   = hc->tx_x; 		tfrc.tfrctx_x_recv = hc->tx_x_recv; 		tfrc.tfrctx_x_calc = hc->tx_x_calc;

Fixed version (after fix):
 static int ccid3_hc_tx_getsockopt(struct sock *sk, const int optname, int len, 	case DCCP_SOCKOPT_CCID_TX_INFO: 		if (len < sizeof(tfrc)) 			return -EINVAL; 		memset(&tfrc, 0, sizeof(tfrc)); 		tfrc.tfrctx_x	   = hc->tx_x; 		tfrc.tfrctx_x_recv = hc->tx_x_recv; 		tfrc.tfrctx_x_calc = hc->tx_x_calc;

Patch:
patch: @@ -535,6 +535,7 @@ static int ccid3_hc_tx_getsockopt(struct sock *sk, const int optname, int len,
 	case DCCP_SOCKOPT_CCID_TX_INFO:
 		if (len < sizeof(tfrc))
 			return -EINVAL;
+		memset(&tfrc, 0, sizeof(tfrc));
 		tfrc.tfrctx_x	   = hc->tx_x;
 		tfrc.tfrctx_x_recv = hc->tx_x_recv;
 		tfrc.tfrctx_x_calc = hc->tx_x_calc;
path: net/dccp/ccids/ccid3.c
Vulnerability: The llc_ui_getname function in net/llc/af_llc.c in the Linux kernel before 3.6 has an incorrect return value in certain circumstances, which allows local users to obtain sensitive information from kernel stack memory via a crafted application that leverages an uninitialized pointer argument.
Vulnerability ID: CVE-2012-6542
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2013-03-15
File: net/llc/af_llc.c
Commit message: llc: fix info leak via getsockname()

The LLC code wrongly returns 0, i.e. "success", when the socket is
zapped. Together with the uninitialized uaddrlen pointer argument from
sys_getsockname this leads to an arbitrary memory leak of up to 128
bytes kernel stack via the getsockname() syscall.

Return an error instead when the socket is zapped to prevent the info
leak. Also remove the unnecessary memset(0). We don't directly write to
the memory pointed by uaddr but memcpy() a local structure at the end of
the function that is properly initialized.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mathias Krause

Vulnerable version (before fix):
 static int llc_ui_getname(struct socket *sock, struct sockaddr *uaddr, 	struct sockaddr_llc sllc; 	struct sock *sk = sock->sk; 	struct llc_sock *llc = llc_sk(sk); 	int rc = 0;  	memset(&sllc, 0, sizeof(sllc)); 	lock_sock(sk); 	if (sock_flag(sk, SOCK_ZAPPED)) 		goto out; 	*uaddrlen = sizeof(sllc); 	memset(uaddr, 0, *uaddrlen); 	if (peer) { 		rc = -ENOTCONN; 		if (sk->sk_state != TCP_ESTABLISHED)

Fixed version (after fix):
 static int llc_ui_getname(struct socket *sock, struct sockaddr *uaddr, 	struct sockaddr_llc sllc; 	struct sock *sk = sock->sk; 	struct llc_sock *llc = llc_sk(sk); 	int rc = -EBADF;  	memset(&sllc, 0, sizeof(sllc)); 	lock_sock(sk); 	if (sock_flag(sk, SOCK_ZAPPED)) 		goto out; 	*uaddrlen = sizeof(sllc); 	if (peer) { 		rc = -ENOTCONN; 		if (sk->sk_state != TCP_ESTABLISHED)

Patch:
patch: @@ -969,14 +969,13 @@ static int llc_ui_getname(struct socket *sock, struct sockaddr *uaddr,
 	struct sockaddr_llc sllc;
 	struct sock *sk = sock->sk;
 	struct llc_sock *llc = llc_sk(sk);
-	int rc = 0;
+	int rc = -EBADF;
 
 	memset(&sllc, 0, sizeof(sllc));
 	lock_sock(sk);
 	if (sock_flag(sk, SOCK_ZAPPED))
 		goto out;
 	*uaddrlen = sizeof(sllc);
-	memset(uaddr, 0, *uaddrlen);
 	if (peer) {
 		rc = -ENOTCONN;
 		if (sk->sk_state != TCP_ESTABLISHED)
path: net/llc/af_llc.c
Vulnerability: The l2tp_ip6_getname function in net/l2tp/l2tp_ip6.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
Vulnerability ID: CVE-2012-6543
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2013-03-15
File: net/l2tp/l2tp_ip6.c
Commit message: l2tp: fix info leak via getsockname()

The L2TP code for IPv6 fails to initialize the l2tp_unused member of
struct sockaddr_l2tpip6 and that for leaks two bytes kernel stack via
the getsockname() syscall. Initialize l2tp_unused with 0 to avoid the
info leak.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: James Chapman <jchapman@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mathias Krause

Vulnerable version (before fix):
 static int l2tp_ip6_getname(struct socket *sock, struct sockaddr *uaddr, 	lsa->l2tp_family = AF_INET6; 	lsa->l2tp_flowinfo = 0; 	lsa->l2tp_scope_id = 0; 	if (peer) { 		if (!lsk->peer_conn_id) 			return -ENOTCONN;

Fixed version (after fix):
 static int l2tp_ip6_getname(struct socket *sock, struct sockaddr *uaddr, 	lsa->l2tp_family = AF_INET6; 	lsa->l2tp_flowinfo = 0; 	lsa->l2tp_scope_id = 0; 	lsa->l2tp_unused = 0; 	if (peer) { 		if (!lsk->peer_conn_id) 			return -ENOTCONN;

Patch:
patch: @@ -410,6 +410,7 @@ static int l2tp_ip6_getname(struct socket *sock, struct sockaddr *uaddr,
 	lsa->l2tp_family = AF_INET6;
 	lsa->l2tp_flowinfo = 0;
 	lsa->l2tp_scope_id = 0;
+	lsa->l2tp_unused = 0;
 	if (peer) {
 		if (!lsk->peer_conn_id)
 			return -ENOTCONN;
path: net/l2tp/l2tp_ip6.c
Vulnerability: The __tun_chr_ioctl function in drivers/net/tun.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
Vulnerability ID: CVE-2012-6547
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2013-03-15
File: drivers/net/tun.c
Commit message: net/tun: fix ioctl() based info leaks

The tun module leaks up to 36 bytes of memory by not fully initializing
a structure located on the stack that gets copied to user memory by the
TUNGETIFF and SIOCGIFHWADDR ioctl()s.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mathias Krause

Vulnerable version (before fix):
 static long __tun_chr_ioctl(struct file *file, unsigned int cmd, 	int vnet_hdr_sz; 	int ret;  	if (cmd == TUNSETIFF || _IOC_TYPE(cmd) == 0x89) 		if (copy_from_user(&ifr, argp, ifreq_len)) 			return -EFAULT;  	if (cmd == TUNGETFEATURES) { 		/* Currently this just means: "what IFF flags are valid?".

Fixed version (after fix):
 static long __tun_chr_ioctl(struct file *file, unsigned int cmd, 	int vnet_hdr_sz; 	int ret;  	if (cmd == TUNSETIFF || _IOC_TYPE(cmd) == 0x89) { 		if (copy_from_user(&ifr, argp, ifreq_len)) 			return -EFAULT; 	} else 		memset(&ifr, 0, sizeof(ifr));  	if (cmd == TUNGETFEATURES) { 		/* Currently this just means: "what IFF flags are valid?".

Patch:
patch: @@ -1379,9 +1379,11 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
 	int vnet_hdr_sz;
 	int ret;
 
-	if (cmd == TUNSETIFF || _IOC_TYPE(cmd) == 0x89)
+	if (cmd == TUNSETIFF || _IOC_TYPE(cmd) == 0x89) {
 		if (copy_from_user(&ifr, argp, ifreq_len))
 			return -EFAULT;
+	} else
+		memset(&ifr, 0, sizeof(ifr));
 
 	if (cmd == TUNGETFEATURES) {
 		/* Currently this just means: "what IFF flags are valid?".
path: drivers/net/tun.c
Vulnerability: The udf_encode_fh function in fs/udf/namei.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted application.
Vulnerability ID: CVE-2012-6548
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2013-03-15
File: fs/udf/namei.c
Commit message: udf: avoid info leak on export

For type 0x51 the udf.parent_partref member in struct fid gets copied
uninitialized to userland. Fix this by initializing it to 0.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Commit author: Mathias Krause

Vulnerable version (before fix):
 static int udf_encode_fh(struct inode *inode, __u32 *fh, int *lenp, 	*lenp = 3; 	fid->udf.block = location.logicalBlockNum; 	fid->udf.partref = location.partitionReferenceNum; 	fid->udf.generation = inode->i_generation;  	if (parent) {

Fixed version (after fix):
 static int udf_encode_fh(struct inode *inode, __u32 *fh, int *lenp, 	*lenp = 3; 	fid->udf.block = location.logicalBlockNum; 	fid->udf.partref = location.partitionReferenceNum; 	fid->udf.parent_partref = 0; 	fid->udf.generation = inode->i_generation;  	if (parent) {

Patch:
patch: @@ -1279,6 +1279,7 @@ static int udf_encode_fh(struct inode *inode, __u32 *fh, int *lenp,
 	*lenp = 3;
 	fid->udf.block = location.logicalBlockNum;
 	fid->udf.partref = location.partitionReferenceNum;
+	fid->udf.parent_partref = 0;
 	fid->udf.generation = inode->i_generation;
 
 	if (parent) {
path: fs/udf/namei.c
Vulnerability: The isofs_export_encode_fh function in fs/isofs/export.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted application.
Vulnerability ID: CVE-2012-6549
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2013-03-15
File: fs/isofs/export.c
Commit message: isofs: avoid info leak on export

For type 1 the parent_offset member in struct isofs_fid gets copied
uninitialized to userland. Fix this by initializing it to 0.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Commit author: Mathias Krause

Vulnerable version (before fix):
 isofs_export_encode_fh(struct inode *inode, 	len = 3; 	fh32[0] = ei->i_iget5_block;  	fh16[2] = (__u16)ei->i_iget5_offset;  /* fh16 [sic] */ 	fh32[2] = inode->i_generation; 	if (parent) { 		struct iso_inode_info *eparent;

Fixed version (after fix):
 isofs_export_encode_fh(struct inode *inode, 	len = 3; 	fh32[0] = ei->i_iget5_block;  	fh16[2] = (__u16)ei->i_iget5_offset;  /* fh16 [sic] */ 	fh16[3] = 0;  /* avoid leaking uninitialized data */ 	fh32[2] = inode->i_generation; 	if (parent) { 		struct iso_inode_info *eparent;

Patch:
patch: @@ -134,6 +134,7 @@ isofs_export_encode_fh(struct inode *inode,
 	len = 3;
 	fh32[0] = ei->i_iget5_block;
  	fh16[2] = (__u16)ei->i_iget5_offset;  /* fh16 [sic] */
+	fh16[3] = 0;  /* avoid leaking uninitialized data */
 	fh32[2] = inode->i_generation;
 	if (parent) {
 		struct iso_inode_info *eparent;
path: fs/isofs/export.c
Vulnerability: The tcp_rcv_state_process function in net/ipv4/tcp_input.c in the Linux kernel before 3.2.24 allows remote attackers to cause a denial of service (kernel resource consumption) via a flood of SYN+FIN TCP packets, a different vulnerability than CVE-2012-2663.
Vulnerability ID: CVE-2012-6638
CWE: CWE-399
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2014-02-15
File: net/ipv4/tcp_input.c
Commit message: tcp: drop SYN+FIN messages

Denys Fedoryshchenko reported that SYN+FIN attacks were bringing his
linux machines to their limits.

Dont call conn_request() if the TCP flags includes SYN flag

Reported-by: Denys Fedoryshchenko <denys@visp.net.lb>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Eric Dumazet

Vulnerable version (before fix):
 int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb, 			goto discard;  		if (th->syn) { 			if (icsk->icsk_af_ops->conn_request(sk, skb) < 0) 				return 1; 

Fixed version (after fix):
 int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb, 			goto discard;  		if (th->syn) { 			if (th->fin) 				goto discard; 			if (icsk->icsk_af_ops->conn_request(sk, skb) < 0) 				return 1; 

Patch:
patch: @@ -5811,6 +5811,8 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
 			goto discard;
 
 		if (th->syn) {
+			if (th->fin)
+				goto discard;
 			if (icsk->icsk_af_ops->conn_request(sk, skb) < 0)
 				return 1;
path: net/ipv4/tcp_input.c
Vulnerability: The sock_setsockopt function in net/core/sock.c in the Linux kernel before 3.5.7 does not ensure that a keepalive action is associated with a stream socket, which allows local users to cause a denial of service (system crash) by leveraging the ability to create a raw socket.
Vulnerability ID: CVE-2012-6657
CWE: CWE-264
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2014-09-28
File: net/core/sock.c
Commit message: net: guard tcp_set_keepalive() to tcp sockets

Its possible to use RAW sockets to get a crash in
tcp_set_keepalive() / sk_reset_timer()

Fix is to make sure socket is a SOCK_STREAM one.

Reported-by: Dave Jones <davej@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Eric Dumazet

Vulnerable version (before fix):
 int sock_setsockopt(struct socket *sock, int level, int optname,  	case SO_KEEPALIVE: #ifdef CONFIG_INET 		if (sk->sk_protocol == IPPROTO_TCP) 			tcp_set_keepalive(sk, valbool); #endif 		sock_valbool_flag(sk, SOCK_KEEPOPEN, valbool);

Fixed version (after fix):
 int sock_setsockopt(struct socket *sock, int level, int optname,  	case SO_KEEPALIVE: #ifdef CONFIG_INET 		if (sk->sk_protocol == IPPROTO_TCP && 		    sk->sk_type == SOCK_STREAM) 			tcp_set_keepalive(sk, valbool); #endif 		sock_valbool_flag(sk, SOCK_KEEPOPEN, valbool);

Patch:
patch: @@ -691,7 +691,8 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
 
 	case SO_KEEPALIVE:
 #ifdef CONFIG_INET
-		if (sk->sk_protocol == IPPROTO_TCP)
+		if (sk->sk_protocol == IPPROTO_TCP &&
+		    sk->sk_type == SOCK_STREAM)
 			tcp_set_keepalive(sk, valbool);
 #endif
 		sock_valbool_flag(sk, SOCK_KEEPOPEN, valbool);
path: net/core/sock.c
Vulnerability: inspircd in Debian before 2.0.7 does not properly handle unsigned integers.  NOTE: This vulnerability exists because of an incomplete fix to CVE-2012-1836.
Vulnerability ID: CVE-2012-6696
CWE: CWE-20
Severity score: 6.4
Project: https://github.com/inspircd/inspircd
Published: 2017-09-25
File: src/dns.cpp
Commit message: Fixed out of bounds memory access from malformed DNS queries that have an invalid length label. Introduced in a6a07de0daa353bcd29056a4535a9c4784c113c8.
Commit author: Adam

Vulnerable version (before fix):
 DNSInfo DNSRequest::ResultIsReady(DNSHeader &header, unsigned length) 				else i += header.payload[i] + 1; /* skip length and label */ 			} 		} 		if (length - i < 10) 			return std::make_pair((unsigned char*)NULL,"Incorrectly sized DNS reply");  		/* XXX: We actually initialise 'rr' here including its ttl field */

Fixed version (after fix):
 DNSInfo DNSRequest::ResultIsReady(DNSHeader &header, unsigned length) 				else i += header.payload[i] + 1; /* skip length and label */ 			} 		} 		if (static_cast<int>(length - i) < 10) 			return std::make_pair((unsigned char*)NULL,"Incorrectly sized DNS reply");  		/* XXX: We actually initialise 'rr' here including its ttl field */

Patch:
patch: @@ -760,7 +760,7 @@ DNSInfo DNSRequest::ResultIsReady(DNSHeader &header, unsigned length)
 				else i += header.payload[i] + 1; /* skip length and label */
 			}
 		}
-		if (length - i < 10)
+		if (static_cast<int>(length - i) < 10)
 			return std::make_pair((unsigned char*)NULL,"Incorrectly sized DNS reply");
 
 		/* XXX: We actually initialise 'rr' here including its ttl field */
path: src/dns.cpp
Vulnerability: Integer signedness error in the archive_write_zip_data function in archive_write_set_format_zip.c in libarchive 3.1.2 and earlier, when running on 64-bit machines, allows context-dependent attackers to cause a denial of service (crash) via unspecified vectors, which triggers an improper conversion between unsigned and signed types, leading to a buffer overflow.
Vulnerability ID: CVE-2013-0211
CWE: CWE-189
Severity score: 2.9
Project: https://github.com/libarchive/libarchive
Published: 2013-09-30
File: libarchive/archive_write.c
Commit message: Limit write requests to at most INT_MAX.
This prevents a certain common programming error (passing -1 to write)
from leading to other problems deeper in the library.
Commit author: Tim Kientzle

Vulnerable version (before fix):
 static ssize_t _archive_write_data(struct archive *_a, const void *buff, size_t s) { 	struct archive_write *a = (struct archive_write *)_a; 	archive_check_magic(&a->archive, ARCHIVE_WRITE_MAGIC, 	    ARCHIVE_STATE_DATA, "archive_write_data"); 	archive_clear_error(&a->archive); 	return ((a->format_write_data)(a, buff, s)); }

Fixed version (after fix):
 static ssize_t _archive_write_data(struct archive *_a, const void *buff, size_t s) { 	struct archive_write *a = (struct archive_write *)_a; 	const size_t max_write = INT_MAX;  	archive_check_magic(&a->archive, ARCHIVE_WRITE_MAGIC, 	    ARCHIVE_STATE_DATA, "archive_write_data"); 	/* In particular, this catches attempts to pass negative values. */ 	if (s > max_write) 		s = max_write; 	archive_clear_error(&a->archive); 	return ((a->format_write_data)(a, buff, s)); }

Patch:
patch: @@ -673,8 +673,13 @@ static ssize_t
 _archive_write_data(struct archive *_a, const void *buff, size_t s)
 {
 	struct archive_write *a = (struct archive_write *)_a;
+	const size_t max_write = INT_MAX;
+
 	archive_check_magic(&a->archive, ARCHIVE_WRITE_MAGIC,
 	    ARCHIVE_STATE_DATA, "archive_write_data");
+	/* In particular, this catches attempts to pass negative values. */
+	if (s > max_write)
+		s = max_write;
 	archive_clear_error(&a->archive);
 	return ((a->format_write_data)(a, buff, s));
 }
path: libarchive/archive_write.c
Vulnerability: The msr_open function in arch/x86/kernel/msr.c in the Linux kernel before 3.7.6 allows local users to bypass intended capability restrictions by executing a crafted application as root, as demonstrated by msr32.c.
Vulnerability ID: CVE-2013-0268
CWE: CWE-264
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2013-02-18
File: arch/x86/kernel/msr.c
Commit message: x86/msr: Add capabilities check

At the moment the MSR driver only relies upon file system
checks. This means that anything as root with any capability set
can write to MSRs. Historically that wasn't very interesting but
on modern processors the MSRs are such that writing to them
provides several ways to execute arbitary code in kernel space.
Sample code and documentation on doing this is circulating and
MSR attacks are used on Windows 64bit rootkits already.

In the Linux case you still need to be able to open the device
file so the impact is fairly limited and reduces the security of
some capability and security model based systems down towards
that of a generic "root owns the box" setup.

Therefore they should require CAP_SYS_RAWIO to prevent an
elevation of capabilities. The impact of this is fairly minimal
on most setups because they don't have heavy use of
capabilities. Those using SELinux, SMACK or AppArmor rules might
want to consider if their rulesets on the MSR driver could be
tighter.

Signed-off-by: Alan Cox <alan@linux.intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Horses <stable@kernel.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Commit author: Alan Cox

Vulnerable version (before fix):
 static int msr_open(struct inode *inode, struct file *file) 	unsigned int cpu; 	struct cpuinfo_x86 *c;  	cpu = iminor(file->f_path.dentry->d_inode); 	if (cpu >= nr_cpu_ids || !cpu_online(cpu)) 		return -ENXIO;	/* No such CPU */

Fixed version (after fix):
 static int msr_open(struct inode *inode, struct file *file) 	unsigned int cpu; 	struct cpuinfo_x86 *c;  	if (!capable(CAP_SYS_RAWIO)) 		return -EPERM;  	cpu = iminor(file->f_path.dentry->d_inode); 	if (cpu >= nr_cpu_ids || !cpu_online(cpu)) 		return -ENXIO;	/* No such CPU */

Patch:
patch: @@ -174,6 +174,9 @@ static int msr_open(struct inode *inode, struct file *file)
 	unsigned int cpu;
 	struct cpuinfo_x86 *c;
 
+	if (!capable(CAP_SYS_RAWIO))
+		return -EPERM;
+
 	cpu = iminor(file->f_path.dentry->d_inode);
 	if (cpu >= nr_cpu_ids || !cpu_online(cpu))
 		return -ENXIO;	/* No such CPU */
path: arch/x86/kernel/msr.c