buffer overflow vulnerability

CVE-2013-4512

Overview: Buffer overflow in the exitcode_proc_write function in arch/um/kernel/exitcode.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly have unspecified other impact by leveraging root privileges for a write operation.

cause：                                                                                                                    We don't cap the size of buffer from the user so we could write past the
end of the array here.  Only root can write to this file.      

source code:

const char __user *buffer, size_t count, loff_t *pos)
{
	char *end, buf[sizeof("nnnnn\0")];
	size_t size;
	int tmp;

	//buffer overflow occurred without the statement
	size = min(count, sizeof(buf));  
	if (copy_from_user(buf, buffer, size))
		return -EFAULT;

	tmp = simple_strtol(buf, &end, 0);
	if ((*end != '\0') && !isspace(*end))
		return -EINVAL;

	uml_exitcode = tmp;
	return count;
}