Bug 157450
| Summary: | CAN-2005-1263 Linux kernel ELF core dump privilege elevation | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 4 | Reporter: | Mark J. Cox <mjc> | ||||
| Component: | kernel | Assignee: | Dave Jones <davej> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Brian Brock <bbrock> | ||||
| Severity: | high | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 4.0 | CC: | pere, pfrields, t.h.amundsen, woodard | ||||
| Target Milestone: | --- | Keywords: | Security | ||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | public=20050511,source=isec,reported=20050510,impact=important | ||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2005-06-08 15:14:12 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
"A locally exploitable flaw has been found in the Linux ELF binary format loader's core dump function that allows local users to gain root privileges and also execute arbitrary code at kernel privilege level." For the full description see http://www.securityfocus.com/archive/1/397966/2005-05-08/2005-05-14/0 A new release which fixes this problem upstream has been released as 2.6.11.9 http://lwn.net/Articles/135583/ Note that a sucessful mitigation to this issue is to limit the production of core files, "ulimit -c 0" placed early during system startup (say from rc.sysinit) will remove the risk of this issue. This went into 2.6.9-9, so its in U1. It would seem that this issue doesn not affect 2.6 kernels. The patch hardens things a bit, but doesn't fix any security issues. In the U1 kernel errata we will list this bug, since we've fixed this issue, but we won't list the CVE name since CAN-2005-1263 has no security context for EL4. An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2005-420.html |
Created attachment 114254 [details] Proposed patch from Greg KH (not backported)