Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

For bugs related to Red Hat Enterprise Linux 3 product line. The current stable release is 3.9. For Red Hat Enterprise Linux 6 and above, please visit Red Hat JIRA https://issues.redhat.com/secure/CreateIssue!default.jspa?pid=12332745 to report new issues.

Bug 142964

Summary:	CAN-2004-1144 x86-64 privilege escalation
Product:	Red Hat Enterprise Linux 3	Reporter:	Josh Bressers <bressers>
Component:	kernel	Assignee:	Jim Paradis <jparadis>
Status:	CLOSED ERRATA	QA Contact:	Brian Brock <bbrock>
Severity:	high	Docs Contact:
Priority:	medium
Version:	3.0	CC:	peterm, petrides, riel, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	impact=important,embargoed=20041222:12
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2004-12-23 20:48:02 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Josh Bressers 2004-12-15 14:16:38 UTC

Petr Vandrovec found a exploitable root hole in all 2.4 x86-64 kernels
that have 32bit emulation enabled.  The bug does not appear in 2.6
because some rewrites in 2.5 timeframe fixed it as a side effect.

This issue does not affect RHEL2.1

Comment 1 Josh Bressers 2004-12-15 14:17:51 UTC

Patch for this issue

--- linux-2.4.28/arch/x86_64/ia32/ia32entry.S.orig      2004-08-08
01:26:04.000000000 +0200
+++ linux-2.4.28/arch/x86_64/ia32/ia32entry.S   2004-12-06
21:36:06.000000000 +0100
@@ -52,6 +52,7 @@
 ENTRY(ia32_syscall)
        swapgs
        sti
+       mov %eax,%eax
        pushq %rax
        cld
        SAVE_ARGS

Comment 2 Mark J. Cox 2004-12-16 10:58:00 UTC

Embargo moved by SUSE to Dec22nd 12GMT

Comment 3 Ernie Petrides 2004-12-20 23:43:34 UTC

A fix for this problem has just been committed to the RHEL3 E5
patch pool this evening (in kernel version 2.4.21-27.0.1.EL).

Comment 4 Mark J. Cox 2004-12-22 13:30:27 UTC

Embargo date and time reached; removing embargo.

Comment 5 Ernie Petrides 2004-12-22 21:57:03 UTC

A fix for this problem has also been committed to the RHEL3 U5
patch pool this evening (in kernel version 2.4.21-27.4.EL).

Comment 6 Josh Bressers 2004-12-23 20:48:02 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2004-689.html