The reiserfs_copy_from_user_to_file_region function in reiserfs/file.c for Linux kernel 2.6.10 and 2.6.11 before 2.6.11-rc4, when running on 64-bit architectures, may allow local users to trigger a buffer overflow as a result of casting discrepancies between size_t and int data types.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Linux_kernel | Linux | 2.6.10 (including) | 2.6.10 (including) |
Linux_kernel | Linux | 2.6.11 (including) | 2.6.11 (including) |
Linux_kernel | Linux | 2.6.11-rc1 (including) | 2.6.11-rc1 (including) |
Linux_kernel | Linux | 2.6.11-rc2 (including) | 2.6.11-rc2 (including) |
Linux_kernel | Linux | 2.6.11-rc3 (including) | 2.6.11-rc3 (including) |
Linux-source-2.6.15 | Ubuntu | dapper | * |
Linux-source-2.6.17 | Ubuntu | edgy | * |