Bug 83143

Summary:	VUL-0: CVE-2005-1762: kernel: amd64 / ptrace can crash the kernel
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Andreas Kleen <ak>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P5 - None
Version:	unspecified
Target Milestone:	---
Hardware:	x86-64
OS:	All
Whiteboard:	CVE-2005-1762: CVSS v2 Base Score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
Found By:	Other	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Attachments:	Check for canonical addresses in ptrace correctly Check segment bases in ptrace correctly Fix check to see if RIP is canonical in ptrace

Description Andreas Kleen 2005-05-09 20:59:21 UTC

There is a bug in the code checking for non canonical addresses while
setting 64bit segment registers. This allows any user process to
oops the kernel.

Comment 1 Andreas Kleen 2005-05-09 20:59:51 UTC

Problem should be in all x86-64 kernels released, so it would need
to be backported to all maintained kernels.

Comment 2 Andreas Kleen 2005-05-09 21:01:11 UTC

Created attachment 36726 [details]
Check for canonical addresses in ptrace correctly

Patch from mainline

Comment 3 Ludwig Nussel 2005-05-10 07:07:02 UTC

Is it public?

Comment 4 Marcus Meissner 2005-05-10 11:15:56 UTC

can you backport the patch to our kernel releases?

Comment 5 Andreas Kleen 2005-05-13 13:36:33 UTC

It should apply to SLES with some offset. Yes the problem is public.
Code hasn't changed much for quite some time, so porting it to other
kernels should be easy.

Comment 6 Andreas Kleen 2005-05-13 15:35:01 UTC

Created attachment 37111 [details]
Check segment bases in ptrace correctly


Sorry the previous patch was wrong and for another bug.
Here is the correct patch. Hubert can you apply 
that everywhere (including SLES8)?

Comment 7 Hubert Mantel 2005-05-17 14:22:00 UTC

done.

Comment 8 Andreas Kleen 2005-05-17 14:23:17 UTC

Thanks, But sorry, there is a report for another ptrace bug that needs
to be fixed too. Bugzilla will come in a jiffie.

Comment 9 Marcus Meissner 2005-05-30 07:43:29 UTC

the patch in SP1 branch is missing this hunk from 2.6.11.11 patch: 
 
is it needed ? 
 
--- a/arch/x86_64/kernel/ptrace.c 
+++ b/arch/x86_64/kernel/ptrace.c 
@@ -149,6 +149,11 @@ static int putreg(struct task_struct *ch 
                                return -EIO; 
                        value &= 0xffff; 
                        break; 
+               case offsetof(struct user_regs_struct, rip): 
+                       /* Check if the new RIP address is canonical */ 
+                       if (value >= TASK_SIZE) 
+                               return -EIO; 
+                       break; 
        } 
        put_stack_long(child, regno - sizeof(struct pt_regs), value); 
        return 0;

Comment 10 Hubert Mantel 2005-05-31 12:10:33 UTC

We tell all of our partners: DO NOT PASTE PATCHES INTO BUGZILLA REPORTS!!!
Submit them as attachment, otherwise it is useless. So please, please, with
sugar on top, don't waste our time.

Comment 11 Andreas Kleen 2005-05-31 12:22:43 UTC

Created attachment 38369 [details]
Fix check to see if RIP is canonical in ptrace

Here's the patch as attachment. That's the real
ptrace-canonical now (we might have another one
of the same name unfortunately in the tree)

Comment 12 Ludwig Nussel 2005-06-08 16:04:45 UTC

ptrace-check-segment CAN-2005-0756 
ptrace-canonical CAN-2005-1762

Comment 13 Ludwig Nussel 2005-06-09 12:43:42 UTC

updates released

Comment 14 Thomas Biege 2009-10-13 21:22:22 UTC

CVE-2005-1762: CVSS v2 Base Score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)