First Last Prev Next    This bug is not in your last search results.
Bug 618156 - VUL-1: kernel: BUG() in cifs code
VUL-1: kernel: BUG() in cifs code
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: General
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Greg Kroah-Hartman
E-mail List
maint:released:sles9:35943 maint:rele...
:
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2010-06-29 07:19 UTC by Sebastian Krahmer
Modified: 2010-12-13 15:57 UTC (History)
2 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sebastian Krahmer 2010-06-29 07:19:15 UTC 
Date: Mon, 28 Jun 2010 16:23:37 -0400 (EDT)
From: Josh Bressers <bressers@redhat.com>
To: oss-security@lists.openwall.com
Cc: "Steven M. Christey" <coley@linus.mitre.org>
In-Reply-To: <4C28604F.3050108@kernel.sg>
Subject: Re: [oss-security] CVE request - kernel: cifs: Fix a kernel BUG
 with remote OS/2 server


Please use CVE-2010-2248

Thanks.

--
    JB
 
 
----- "Eugene Teo" <eugeneteo@kernel.sg> wrote:

> "This was known to trigger with a OS/2 server. The server sets
> pSMBr->CountHigh to a incorrect value even in case of normal writes.
> This results in 'nbytes' being computed wrongly and triggers a kernel
>
> BUG at mm/filemap.c.
>
>      void iov_iter_advance(struct iov_iter *i, size_t bytes)
>      {
>              BUG_ON(i->count < bytes);    <--- BUG here
>
> Why the server is setting 'CountHigh' is not clear but only does so
> after writing 64k bytes. Though this looks like the server bug, the
> client side crash may not be acceptable.
>
> The workaround is to mask off high 16 bits if the number of bytes
> written as returned by the server is greater than the bytes requested
> by
> the client."
>
> https://bugzilla.redhat.com/show_bug.cgi?id=608583
> http://git.kernel.org/linus/6513a81e9325d712f1bfb9a1d7b750134e49ff18
Comment 1 Sebastian Krahmer 2010-06-30 06:23:16 UTC 
Via oss-sec:

pSMBr->CountHigh looks to have been introduce by commit
381a420f5b23cedd9e166e052a93a7f4237bd57c back in 2.6.12-rc2.
So would it be said this issue has been around since then?

- Armin
Comment 2 Sebastian Krahmer 2010-06-30 06:34:18 UTC 
Which tree are you using? I got: fatal: bad object
381a420f5b23cedd9e166e052a93a7f4237bd57c.

->CountHigh was added long ago. Even v2.6.9 (rhel-4) is affected.

Eugene
Comment 3 Sebastian Krahmer 2010-06-30 13:53:50 UTC 
>On 06/29/2010 02:02 PM, Eugene Teo wrote:
>>On 06/30/2010 12:57 AM, akuster wrote:
>>>pSMBr->CountHigh looks to have been introduce by commit
>>>381a420f5b23cedd9e166e052a93a7f4237bd57c back in 2.6.12-rc2.

2.6.12-rc1.

>>>So would it be said this issue has been around since then?

Yes.

>>->CountHigh was added long ago. Even v2.6.9 (rhel-4) is affected.
>I don't see that in our 2.6.10 tree.

Correction, we backported patches that introduced that in rhel-4.

Thanks, Eugene
Comment 4 Thomas Biege 2010-08-09 07:55:10 UTC 
mass change P5->P3
Comment 5 Jeff Mahoney 2010-08-31 19:26:55 UTC 
The fix for this was written by Suresh.

I've applied the fix to SLES9 SP4.
I've applied the fix to SLES10 SP3 and SP4.
SLE11 has the fix via 2.6.27.49 (and had our original fix)
I've updated the fix to openSUSE 11.2.
SLE11 SP1 has the fix via 2.6.32.12.
The fix is upstream in 2.6.34.

SLERT and Moblin may be affected.
Comment 6 Mike Galbraith 2010-09-06 04:24:29 UTC 
SlE11-RT-SP1 fixed via 2.6.33.3 (commit c171476)
Comment 7 Swamp Workflow Management 2010-09-22 21:31:34 UTC 
Update released for: kernel-default, kernel-default-debug, kernel-iseries64, kernel-iseries64-debug, kernel-pmac64, kernel-pmac64-debug, kernel-pseries64, kernel-pseries64-debug, kernel-smp, kernel-smp-debug, kernel-source, kernel-syms, um-host-kernel, kernel-update.ycp, install-kernel-non-interactive.sh
Products:
SUSE-CORE 9 (ppc)
Comment 8 Swamp Workflow Management 2010-09-22 21:36:22 UTC 
Update released for: kernel-64k-pagesize, kernel-64k-pagesize-debug, kernel-debug, kernel-debug-debug, kernel-default, kernel-default-debug, kernel-sn2, kernel-sn2-debug, kernel-source, kernel-syms, um-host-kernel, kernel-update.ycp, install-kernel-non-interactive.sh
Products:
SUSE-CORE 9 (ia64)
Comment 9 Swamp Workflow Management 2010-09-22 23:19:33 UTC 
Update released for: kernel-default, kernel-default-debug, kernel-smp, kernel-smp-debug, kernel-source, kernel-syms, kernel-xen, kernel-xen-debug, um-host-kernel, xen-kmp, kernel-update.ycp, install-kernel-non-interactive.sh
Products:
SUSE-CORE 9 (x86_64)
Comment 10 Swamp Workflow Management 2010-09-22 23:44:46 UTC 
Update released for: kernel-bigsmp, kernel-bigsmp-debug, kernel-debug, kernel-debug-debug, kernel-default, kernel-default-debug, kernel-smp, kernel-smp-debug, kernel-source, kernel-syms, kernel-um, kernel-um-debug, kernel-xen, kernel-xen-debug, kernel-xenpae, kernel-xenpae-debug, um-host-install-initrd, um-host-kernel, xen-kmp, kernel-update.ycp, install-kernel-non-interactive.sh
Products:
Novell-Linux-POS 9 (i386)
SUSE-CORE 9 (i386)
Comment 11 Swamp Workflow Management 2010-09-23 13:09:15 UTC 
Update released for: kernel-debug, kernel-debug-base, kernel-debug-base-debuginfo, kernel-debug-debuginfo, kernel-debug-debugsource, kernel-debug-devel, kernel-debug-devel-debuginfo, kernel-default, kernel-default-base, kernel-default-base-debuginfo, kernel-default-debuginfo, kernel-default-debugsource, kernel-default-devel, kernel-default-devel-debuginfo, kernel-desktop, kernel-desktop-base, kernel-desktop-base-debuginfo, kernel-desktop-debuginfo, kernel-desktop-debugsource, kernel-desktop-devel, kernel-desktop-devel-debuginfo, kernel-pae, kernel-pae-base, kernel-pae-base-debuginfo, kernel-pae-debuginfo, kernel-pae-debugsource, kernel-pae-devel, kernel-pae-devel-debuginfo, kernel-source, kernel-source-vanilla, kernel-syms, kernel-trace, kernel-trace-base, kernel-trace-base-debuginfo, kernel-trace-debuginfo, kernel-trace-debugsource, kernel-trace-devel, kernel-trace-devel-debuginfo, kernel-vanilla, kernel-vanilla-base, kernel-vanilla-base-debuginfo, kernel-vanilla-debuginfo, kernel-vanilla-debugsource, kernel-vanilla-devel, kernel-vanilla-devel-debuginfo, kernel-xen, kernel-xen-base, kernel-xen-base-debuginfo, kernel-xen-debuginfo, kernel-xen-debugsource, kernel-xen-devel, kernel-xen-devel-debuginfo, preload-kmp-default, preload-kmp-desktop
Products:
openSUSE 11.2 (debug, i586, x86_64)
Comment 12 Swamp Workflow Management 2010-10-20 17:56:06 UTC 
Update released for: kernel-bigsmp, kernel-bigsmp-debug, kernel-debug, kernel-debug-debug, kernel-default, kernel-default-debug, kernel-smp, kernel-smp-debug, kernel-source, kernel-syms, kernel-um, kernel-um-debug, kernel-xen, kernel-xen-debug, kernel-xenpae, kernel-xenpae-debug, um-host-install-initrd, um-host-kernel, xen-kmp
Products:
Open-Enterprise-Server 9 (i386)
Comment 13 Thomas Biege 2010-11-09 13:34:25 UTC 
I assume it was fixed
Comment 15 Thomas Biege 2010-11-09 15:00:46 UTC 
CVE-2010-2248: CVSS v2 Base Score: 7.1 (important) (AV:N/AC:M/Au:N/C:N/I:N/A:C)
CVE-2010-2248: Input Validation (CWE-20)
Comment 16 Marcus Meissner 2010-12-13 14:28:42 UTC 
We just released a kernel update for SUSE Linux Enterprise 10 Service Pack 3, which fixes/mentions this bugreport. Released kernel version is 2.6.16.60-0.74.7.
Comment 17 Swamp Workflow Management 2010-12-13 14:31:30 UTC 
Update released for: kernel-bigsmp, kernel-bigsmp-debuginfo, kernel-debug, kernel-debug-debuginfo, kernel-default, kernel-default-debuginfo, kernel-kdump, kernel-kdump-debuginfo, kernel-kdumppae, kernel-kdumppae-debuginfo, kernel-smp, kernel-smp-debuginfo, kernel-source, kernel-source-debuginfo, kernel-syms, kernel-syms-debuginfo, kernel-vmi, kernel-vmi-debuginfo, kernel-vmipae, kernel-vmipae-debuginfo, kernel-xen, kernel-xen-debuginfo, kernel-xenpae, kernel-xenpae-debuginfo
Products:
SLE-DEBUGINFO 10-SP3 (i386)
SLE-DESKTOP 10-SP3 (i386)
SLE-SDK 10-SP3 (i386)
SLE-SERVER 10-SP3 (i386)
Comment 18 Swamp Workflow Management 2010-12-13 15:04:18 UTC 
Update released for: kernel-debug, kernel-debug-debuginfo, kernel-default, kernel-default-debuginfo, kernel-source, kernel-source-debuginfo, kernel-syms
Products:
SLE-DEBUGINFO 10-SP3 (ia64)
SLE-SDK 10-SP3 (ia64)
SLE-SERVER 10-SP3 (ia64)
Comment 19 Swamp Workflow Management 2010-12-13 15:12:23 UTC 
Update released for: kernel-default, kernel-default-debuginfo, kernel-source, kernel-syms
Products:
SLE-DEBUGINFO 10-SP3 (s390x)
SLE-SERVER 10-SP3 (s390x)
Comment 20 Swamp Workflow Management 2010-12-13 15:28:35 UTC 
Update released for: kernel-default, kernel-default-debuginfo, kernel-iseries64, kernel-iseries64-debuginfo, kernel-kdump, kernel-kdump-debuginfo, kernel-ppc64, kernel-ppc64-debuginfo, kernel-source, kernel-source-debuginfo, kernel-syms
Products:
SLE-DEBUGINFO 10-SP3 (ppc)
SLE-SDK 10-SP3 (ppc)
SLE-SERVER 10-SP3 (ppc)
Comment 21 Swamp Workflow Management 2010-12-13 15:57:42 UTC 
Update released for: kernel-debug, kernel-debug-debuginfo, kernel-default, kernel-default-debuginfo, kernel-kdump, kernel-kdump-debuginfo, kernel-smp, kernel-smp-debuginfo, kernel-source, kernel-source-debuginfo, kernel-syms, kernel-xen, kernel-xen-debuginfo
Products:
SLE-DEBUGINFO 10-SP3 (x86_64)
SLE-DESKTOP 10-SP3 (x86_64)
SLE-SAP-APL 10-SP3 (x86_64)
SLE-SDK 10-SP3 (x86_64)
SLE-SERVER 10-SP3 (x86_64)
First Last Prev Next    This bug is not in your last search results.