Bug 62088 (CVE-2004-0887)

From: Martin Schwidefsky <schwidefsky@de.ibm.com>                                
To: vendor-sec@lst.de                                                            
Subject: [vendor-sec] s390: sacf local root exploit.                             
                                                                                 
Hi,                                                                              
crashme found a problem on s390/zSeries (31/64 bit) that is                      
suitable for a local root exploit. sacf is a semi-privileged                     
instruction that is used to set the address-space control bits                   
in the psw. The address-space mode controls from which address                   
space the cpu fetches instruction and loads/stores data. Naturally               
we can't allow a user process to use the sacf instruction to                     
"leave" the user address space (home space). To prevent the use                  
of the sacf in user space the home-space-switch-event-control                    
bit in control register 13 is enabled. Whenever sacf is used to                  
leave the home space we get a program interruption. The trap                     
now is that we get the program interruption AFTER sacf has                       
switched the address-space mode control bits in the user psw.                    
                                                                                 
The fix for ptrace (ChangeSet 1.1371.585.6) that prevents the                    
removal of the single-step bit due to a signal introduced the                    
problem because the address-space control is not reset to                        
home-space mode anymore. Therefore a signal handler for the                      
illegal operation caused by the sacf will get control in primary                 
space mode which allows a malicious user space program to modify                 
data in the kernel space.                                                        
                                                                                 
Affected kernels are 2.6.5 to 2.6.8.                                             
                                                                                 
blue skies,                                                                      
  Martin.                                                                        
                                                                                 
Martin Schwidefsky                                                               
Linux for zSeries Development & Services                                         
IBM Deutschland Entwicklung GmbH                                                 
                                                                                 
---                                                                              
                                                                                 
[PATCH] s390: sacf local root exploit.                                           
                                                                                 
From: Martin Schwidefsky <schwidefsky@de.ibm.com>                                
                                                                                 
s390 core changes:                                                               
 - Force user process back to home space mode in space switch event              
   exception handler.                                                            
                                                                                 
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>                       
                                                                                 
diffstat:                                                                        
 arch/s390/kernel/traps.c |   17 ++++++++++++++++-                               
 1 files changed, 16 insertions(+), 1 deletion(-)