Attachment 38758 Details for Bug 87244

[patch] patch from Matt Chapman

Security-flaw-in-IA64-ptrace.txt (text/plain), 1.26 KB, created by Tony Luck on 2005-06-07 16:18:25 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tony Luck

Created: 2005-06-07 16:18:25 UTC

Size: 1.26 KB

patch

obsolete

>From: Matt Chapman [matthewc@hp.com]
>Sent: Monday, June 06, 2005 10:51 AM
>To: Luck, Tony
>Subject: [PATCH] Security flaw in IA64 ptrace
>
>Tony,
>
>This patch fixes handling of accesses to ar.rsc via ptrace.
>(Currently the user can write the pl field and thereby
>read/write kernel memory via the RSE.)
>
>I ran it by David and he said to send it to you directly.
>
>As this is a security fix, it would be good if this made it
>into 2.6.12 and vendor kernels.
>
>Thanks,
>Matt
>
>Signed-off-by: Matthew Chapman <matthewc@hp.com>
>
>
>--- linux-2.6.11.11/arch/ia64/kernel/ptrace.c.old	2005-03-02 00:38:33.000000000 -0700
>+++ linux-2.6.11.11/arch/ia64/kernel/ptrace.c	2005-06-06 11:16:18.000000000 -0600
>@@ -924,6 +924,13 @@
> 				*data = (pt->cr_ipsr & IPSR_MASK);
> 			return 0;
> 
>+		      case PT_AR_RSC:
>+			if (write_access)
>+				pt->ar_rsc = *data | (3 << 2); /* force PL3 */
>+			else
>+				*data = pt->ar_rsc;
>+			return 0;
>+
> 		      case PT_AR_RNAT:
> 			urbs_end = ia64_get_user_rbs_end(child, pt, NULL);
> 			rnat_addr = (long) ia64_rse_rnat_addr((long *)
>@@ -975,9 +982,6 @@
> 		      case PT_AR_BSPSTORE:
> 			ptr = pt_reg_addr(pt, ar_bspstore);
> 			break;
>-		      case PT_AR_RSC:
>-			ptr = pt_reg_addr(pt, ar_rsc);
>-			break;
> 		      case PT_AR_UNAT:
> 			ptr = pt_reg_addr(pt, ar_unat);
> 			break;

Actions: View | Diff

Attachments on bug 87244: 38758 | 39006 | 39074 | 41174