Bugzilla – Bug 42930
VUL-0: CVE-2003-0956: kernel: O_DIRECT exposes stale disk blocks
Last modified: 2021-09-29 14:37:29 UTC
There is a race condition when two processes access a file at the same time; one reading with O_DIRECT, the other writing to it. The reading process will see random stale disk blocks.
<!-- SBZ_reproduce --> See attached exploit.
Created attachment 13106 [details] Exploit from Stephen Tweedie. CONFIDENTIAL
*** Bug 42934 has been marked as a duplicate of this bug. ***
Raising priority to critical. Any comments/progress on this Hubert? Shall we assign it to the security people?
this was fixed in our tree months ago (possibly in SP2a too I think but I'm unsure). also the bug happened best by writing with O_DIRECT while reading with O_DIRECT AFIK. Now in current kernels it's all serialized by the i_alloc_sem. This has been fixed in mainline too (don't remeber by memory exactly which release though, I can check it if you need to know). But CVS head certainly it's just fixed, just grep for i_alloc_sem in mm/filemap.c, the fixed kernels will have i_alloc_sem there.
Assigning to security people to confirm this is fixed, at least for SP3.
Please comment the Status of this bug!
According to Hubert this fix is in 2.4.21 (At least for SP3 RC2) Andrea, can zou please confirm this? The bug remains open, because the fix has still to be done for the older kernels.
yes, the filename of the patch that fixes the security problem is 9999901_O_DIRECT-1 and it's included in SP3 (aka CVS head) but not in SP2a. the simpler way to verify if a kernel has the fix or not, is to grep for i_alloc_sem. If i_alloc_sem is in the sourcecode, then the kernel is safe and correct. If i_alloc_sem is missing, then the kernel is not safe.
When SP3 is released, we really should also fix this problem for older kernels. However the patch from current kernel does not apply to older versions. Resolving the conflicts is not trivial, it needs to be done by somebody who really understands the code. Andrea, can you do that? But only after SP3 is released; we still have some quite severe problems here...
Fixed.
<!-- SBZ_reopen -->Reopened by okir@suse.de at Wed Dec 3 09:56:53 2003
Reopened for security-team tracking
I think all kernels are released now. even the School Server isnt in the patch_status queue anymore.
CVE-2003-0956
CVE-2003-0956: CVSS v2 Base Score: 2.6 (AV:L/AC:H/Au:N/C:P/I:P/A:N)