|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2005-1763: kernel: Another hole in x86-64 ptrace | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Andreas Kleen <ak> |
| Component: | Incidents | Assignee: | Security Team bot <security-team> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Critical | ||
| Priority: | P5 - None | CC: | security-team |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | x86-64 | ||
| OS: | All | ||
| Whiteboard: | CVE-2005-1763: CVSS v2 Base Score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C) | ||
| Found By: | Other | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
| Attachments: |
Patch
Additional ptrace overflow patch |
||
|
Description
Andreas Kleen
2005-05-17 15:48:43 UTC
Created attachment 37412 [details]
Patch
andi? can you check up on this? This patch should be in all trees. While I don't think it will lead to an immediate root exploit I would feel safer if it was fixed everywhere. Andi, can you please also submit a 2.4 version of the patch? andi thinks this is more severe ... you can overwrite the begin of pages not belonging to you. Created attachment 38387 [details]
Additional ptrace overflow patch
This patch needs to be applied *in addition* to
the previous patch in this bug to fully close
the root hole.
Hmm, no the previous patch was no good. I will do a better one. After some more consideration I think only the patch in comment #1 is sufficient to fix the problem. Forget the one in #6. Hubert, please apply to all branches. Andi, I _STILL_ need a 2.4 version of this fix! and a final 2.6 patch if it is not done yet ... (regarding comment #8) According to comment #8, only the additional patch in #6 is bogus and the one from #1 should be applied to all trees. At least this is what I did now. After checking the 2.4 trees, we came to the conclusion that those trees are not vulnerable by this problem. So everything should finally be fine now. Kernels have been submitted for check in. The first patch should apply pretty easily to 2.4 too. no, the code is different in 2.4.21:
for poke:
if ((addr & 7) || addr < 0 ||
addr > sizeof(struct user) - 7)
break;
if (addr < sizeof(struct user_regs_struct)) {
ret = putreg(child, addr, data);
break;
}
and for peek similar.
This code is safe against the problem fixed by the patch for 2.6 I think.
Has the patch been applied to SLES9 SP2? If it's only the 2.4 patch that's missing, can we change the target to SLES8 please? x86_64-ptrace-overflow CAN-2005-1763 updates released CVE-2005-1763: CVSS v2 Base Score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C) |