Off-by-one error in afs_pioctl.c in OpenAFS before 1.6.16 might allow local users to cause a denial of service (memory overwrite and system crash) via a pioctl with an input buffer size of 4096 bytes.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openafs | Openafs | * | 1.6.15 (including) |
| Openafs | Ubuntu | esm-apps/xenial | * |
| Openafs | Ubuntu | precise | * |
| Openafs | Ubuntu | trusty | * |
| Openafs | Ubuntu | upstream | * |
| Openafs | Ubuntu | wily | * |
| Openafs | Ubuntu | xenial | * |
References
- http://git.openafs.org/?p=openafs.git%3Ba=commitdiff%3Bh=2ef863720da4d9f368aaca0461c672a3008195ca
- http://www.debian.org/security/2016/dsa-3569
- https://www.openafs.org/dl/1.6.16/RELNOTES-1.6.16
- http://git.openafs.org/?p=openafs.git%3Ba=commitdiff%3Bh=2ef863720da4d9f368aaca0461c672a3008195ca
- http://www.debian.org/security/2016/dsa-3569
- https://www.openafs.org/dl/1.6.16/RELNOTES-1.6.16