Bugzilla – Bug 63427
VUL-0: CVE-2004-1068: kernel: race condition in unix_dgram_recvmsg()
Last modified: 2021-11-03 16:24:15 UTC
Hi, the following "warning" from Paul Starzetz was posted to Bugtraq: Date: Fri, 19 Nov 2004 20:26:21 +0100 (CET) From: Paul Starzetz <ihaquer@isec.pl> Reply-To: security@isec.pl To: bugtraq@securityfocus.com, full-disclosure@lists.netsys.com, vulnwatch@vulnwatch.org Subject: Addendum, recent Linux <= 2.4.27 vulnerabilities -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, while looking at the changelog for 2.4.28, I've found, that a bug I independently came over some days ago has been fixed in that release: David S. Miller: o [AF_UNIX]: Serialize dgram read using semaphore just like stream That fixes missing serialization in unix_dgram_recvmsg(). I was slightly suprised reading the 2.4.27 code and I strongly believe that the flaw is fully exploitable to gain elevated privileges. There is a subtle race condition finally permitting a non-root user to increment (up to 256 times) any arbitrary location(s) in kernel space. The condition is not easy to exploit since an attacker must trick kmalloc() to sleep on allocation of a special chunk of memory and then convince the scheduler to execute another thread. But it is feasible. Conclusion: update as quick as possible to 2.4.28. - -- Paul Starzetz iSEC Security Research http://isec.pl/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQFBnkjiC+8U3Z5wpu4RAiCJAKCpqAD3jD/Ih6CSVxOUW0wnkXVY8QCgs584 x03r/RbphAViQPJrM8Fqj28= =Adi4 -----END PGP SIGNATURE-----
<!-- SBZ_reproduce --> -
Created attachment 26455 [details] mail.txt
atached mail with samle DoS program...
actually the program is not for this bug. important is just the line of Paul: |Btw. we have a working proof-of-concept root exploit for the AF_UNIX issue |http://lists.netsys.com/pipermail/full-disclosure/2004-November/029055.html | |preapre upgrades for your users.
Who can extract the needed fix from 2.4.28? Will we delay the kernels that are already in the update queue for this one?
Created attachment 26457 [details] BK changeset for 2.4 kernels All those bitkeeper changesets can be downloaded from http://linux.bkbits.net.
we will not delay the current kernels. hubert, can you merge the fix into the affected kernels (everything up to 9.0 i think)
CAN-2004-1068 for http://www.securityfocus.com/bid/11715 Missing serialization in unix_dgram_recvmsg() could lead to elevated privileges. Affects 2.4.27 and earlier, Affects 2.6.9 and earlier.
Sorry to interrupt: I need to know if SLES9 is affected. Seems no, right?
It does. Argh.
I have now checked the fix into the SLES9_BRANCH, SLES9_SP1_BRANCH, and HEAD. Hubert, can you please update the 2.4 repositories? Marcus, how to proceed?
Andreas, could you please, for completeness, attach the 2.6 patch to this bug?
Created attachment 26667 [details] BK changeset for 2.6 kernels
Danke!
next step is to apply the patch to all 2.4 based kernels
Ok, it is in all trees now (9.2 was still missing). Re-assigning to security-team. Kernels will be submitted for autobuild after I also checked in the ELF fix.
-> marcus is tracking the kernel update.
updates and advisory released.
CVE-2004-1068: CVSS v2 Base Score: 6.2 (AV:L/AC:H/Au:N/C:C/I:C/A:C)