Bugzilla – Bug 87244
VUL-0: CVE-2005-1761: kernel: Malicious user can use ptrace to crash the system
Last modified: 2021-11-04 16:18:45 UTC
Is this bug publicly visible ... I'd like to defer adding details until I know whether I'm writing for the whole world. The bug is old ... most kernel versions are affected. IA64 specific. I'd like to send the patch to Linus for inclusion in 2.6.12 (only about a week away according to rumour).
it now no longer is publically visible, so please add. we had several ia64 ptrace issues already fixed, is this a previously known one?
Created attachment 38758 [details] patch from Matt Chapman New ptrace bug for ia64 (sigh). Matt Chapman found this, and supplied the attached fix.
can you work with the security@kernel.org contact please. and keep us posted on disclosure dates. andreas, this must stay out of CVS until disclosure ... Greg, FYI only for now
CAN-2005-0761
wrong number, it's CAN-2005-1761
Created attachment 39006 [details] version 2 - close hole via ptrace_setregs too Aargh! David Mosberger sent me e-mail last night saying that he thought there might be another code path for this bug through ptrace_setregs(). He's right. Here's an updated patch that should close that too. But so far it is untested (apart from that it compiles). No reviews yet either.
I have an ACK from David Mosberger that the new patch is OK.
But now Christ Wright has spotted another place (restore_sigcontext) where ar.rsc can be loaded with an arbitrary value supplied from user space. I'm giving up on trying to coordinate this with the 2.6.12 release. It will go into a 2.6.12.y release.
Created attachment 39074 [details] Fix restore_sigcontext() path too This should be the final version. If there are no problems with it, then I will release this on Wed June 22nd at noon PDT.
public now
Checked into SP2. Any other branch?
no, unless Intel thinks it is problematic for SLES 8 too.
Tony? does this affect the 2.4 kernels?
ptrace.c has seen some major changes between 2.4 and 2.6, but it looks like the same problem is present there too.
Created attachment 41174 [details] Backport to 2.4.21
Checked into SLES8 kernel.
updates released
this patch does not appear in the mainline 2.4 yet.
CVE-2005-1761: CVSS v2 Base Score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)