Integer signedness error in the fw_ioctl (FW_IOCTL) function in the FireWire (IEEE-1394) drivers (dev/firewire/fwdev.c) in various BSD kernels, including DragonFlyBSD, FreeBSD 5.5, MidnightBSD 0.1-CURRENT before 20061115, NetBSD-current before 20061116, NetBSD-4 before 20061203, and TrustedBSD, allows local users to read arbitrary memory contents via certain negative values of crom_buf->len in an FW_GCROM command. NOTE: this issue has been labeled as an integer overflow, but it is more like an integer signedness error.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Dragonflybsd | Dragonflybsd | * | * |
| Freebsd | Freebsd | 5.5 (including) | 5.5 (including) |
| Midnightbsd | Midnightbsd | 0.1-current (including) | 0.1-current (including) |
| Netbsd | Netbsd | 2.0.4 (including) | 2.0.4 (including) |
| Trustedbsd | Trustedbsd | * | * |
| Kfreebsd-5 | Ubuntu | dapper | * |
| Kfreebsd-5 | Ubuntu | edgy | * |
| Kfreebsd-5 | Ubuntu | feisty | * |
| Kfreebsd-5 | Ubuntu | gutsy | * |
| Kfreebsd-5 | Ubuntu | hardy | * |
| Kfreebsd-5 | Ubuntu | intrepid | * |