CD-ROM driver rips a security leak in the Linux kernel

A minor typo in the kernel source can allow attackers to get root access to a Linux computer using, for example, homemade USB devices. The problem is in a function in the kernel's CD-ROM driver.

The dvd_read_bca() function in the driver drivers/cdrom/cdrom.c creates a buffer of a specified size for packets on the stack, but because of a typo it allocates too much memory to the data buffer to be copied. Manipulated hardware can exploit this weak point by using long packets to provoke a buffer overflow and execute injected code.

Kernel versions up to and including the current 2.6.17.3 are affected. Those who compile their kernel themselves can use the simple patch and create a new kernel; Linux distributions should provide new packets soon.

Attempted attacks via prepared USB hardware could become more common. For instance, Steve Stasiukonis of Secure Network Technologies managed to use manipulated USB sticks as Trojan horses a few weeks ago to gain access to confidential data.

Also see:

• Possible buffer overflow in DVD handling, entry in the Linux kernel's bug tracking system
• Patch for the typo

(ehe)