Bug 142251 - VUL-0: kernel: dm-crypt information leak
Summary: VUL-0: kernel: dm-crypt information leak
Status: RESOLVED FIXED
Alias: None
Product: SUSE LINUX 10.0
Classification: openSUSE
Component: Kernel (show other bugs)
Version: Final
Hardware: Other Other
: P5 - None : Minor
Target Milestone: ---
Assignee: Security Team bot
QA Contact: E-mail List
URL:
Whiteboard: affected:sles9sp4,sles9sp3, 9.2,9.3,1...
Keywords:
Depends on:
Blocks:
 
Reported: 2006-01-10 09:44 UTC by Marcus Meissner
Modified: 2009-10-14 08:03 UTC (History)
2 users (show)

See Also:
Found By: Other
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
The patch from 9.3 (981 bytes, patch)
2006-02-24 00:09 UTC, Neil Brown 		Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2006-01-10 09:44:18 UTC 
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0095

only a minor problem in my eyes.

dm-crypt in Linux kernel 2.6.15 and earlier does not clear a structure before it is freed, which leads to a memory disclosure that could allow local users to obtain sensitive information about a cryptographic key.
Comment 2 Neil Brown 2006-01-24 04:56:50 UTC 
The current sles10 CVS has this fixed as it based on -git9.
I have backported into sles9-sp4, fixing it on the way.

I've reported the problem with the patch to Authors and linux-kernel.

Maybe I'll add the fix to HEAD once it gets to mainline....
Comment 3 Marcus Meissner 2006-01-26 17:31:01 UTC 
this likely applies to the other kernel branches too, right?
Comment 4 Neil Brown 2006-02-24 00:09:56 UTC 
Created attachment 70077 [details]
The patch from 9.3

Here is the patch from 9.3 which should replace the one in SLES9-SP3
Comment 5 Neil Brown 2006-02-24 00:11:12 UTC 
Oops.... wrong bug... now how did I do that....

Sorry, forget comment #4 and comment #5.
Comment 6 Marcus Meissner 2006-04-25 11:15:17 UTC 
can you/someone else apply the patch to the other active branches?

cvs tags are listed in:
http://w3d.suse.de/Dev/Labs/Pubs/Kernel_Building.html
Comment 7 Neil Brown 2006-04-27 03:03:46 UTC 
Ok, I've applied it and updated the status whiteboard.

NeilBrown
Comment 8 Marcus Meissner 2006-04-27 08:49:44 UTC 
thanks neil!
Comment 9 Marcus Meissner 2006-05-03 06:43:30 UTC 
marking fixed, since all done exccept pushing out via update.
Comment 10 Thomas Biege 2009-10-13 23:07:31 UTC 
CVE-2006-0095: CVSS v2 Base Score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)