CVE-2005-0531

A local user can trigger a buffer overflow by passing negative arguments to the ATM ioctl path. The `atm_get_addr` function uses a signed `int size` parameter and a `total < size ? total : size` comparison that may underflow when negative values are supplied, leading to an incorrect copy size in `copy_to_user` [ref_id=1][ref_id=2]. The attacker needs local access to issue the `ATM_GETADDR` ioctl.

The `atm_get_addr` function in `net/atm/addr.c` and the `atm_dev_ioctl` function in `net/atm/resources.c` are at fault. The advisory notes that this codepath is suspicious but was not verified on real hardware [ref_id=1][ref_id=2].

The advisory states that kernel 2.6.11-rc4 fixes the anomalies and adds checks at the VFS layer and in `copy_from_user` [ref_id=1][ref_id=2]. Individual patches are referenced at kernel.org BitKeeper URLs. The fix likely adds proper validation of the `size` parameter in `atm_get_addr` to reject negative values, preventing the signedness confusion that leads to the buffer overflow.