|
The iBCS2 system call translator for statfs erroneously used theuser-supplied length parameter when copying a kernel data structureinto userland. If the length parameter were larger than required,then instead of copying only the statfs-related data structure,additional kernel memory would also be made available to the user. |
To browse through our weekly Linux Advisory Watch newsletters,