Note that CAN-2005-1264 had already been assigned to the raw device issue,
as documented in the "[PATCH] Fix root hole in raw device" post to the
linux-kernel list by Greg KH:
http://marc.theaimsgroup.com/?l=linux-kernel&m=111630512512222
So, the CAN-2005-1589 will only be used for the pktcdvd issue. Working
descriptions are below and will be on the CVE web site later today.
It appears that this slightly erroneous candidate assignment occurred
because of insufficient coordination between researcher and vendor.
Regards,
Steve Christey
CVE Editor
======================================================
Candidate: CAN-2005-1264
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1264
Reference: MLIST:[linux-kernel] 20050517 [PATCH] Fix root hole in raw device
Reference: URL:http://marc.theaimsgroup.com/?l=linux-kernel&m=111630512512222
Reference: VULNWATCH:20050516 Linux kernel pktcdvd and rawdevice ioctl break
user space limit vulnerability
Reference:
URL:http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0045.html
Raw character devices (raw.c) in the Linux kernel 2.6.x call the wrong
function before passing an ioctl to the block device, which crosses
security boundaries by making kernel address space accessible from
user space, a similar vulnerability to CAN-2005-1589.
======================================================
Candidate: CAN-2005-1589
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1589
Reference: MLIST:[linux-kernel] 20050517 [PATCH] Fix root hole in pktcdvd
Reference:
URL:http://marc.theaimsgroup.com/?l=linux-kernel&m=111630531515901&w=2
Reference: VULNWATCH:20050516 Linux kernel pktcdvd and rawdevice ioctl break
user space limit vulnerability
Reference:
URL:http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0045.html
The pkt_ioctl function in the pktcdvd block device ioctl handler
(pktcdvd.c) in Linux kernel 2.6.12-rc4 and earlier calls the wrong
function before passing an ioctl to the block device, which crosses
security boundaries by making kernel address space accessible from
user space and allows local users to execute arbitrary code, a similar
vulnerability to CAN-2005-1264.
