Bug 172357

Summary: CVE-2005-3257 loadkeys key bindings
Product: Red Hat Enterprise Linux 4 Reporter: Mark J. Cox <mjc>
Component: kernelAssignee: Aristeu Rozanski <arozansk>
Status: CLOSED ERRATA QA Contact: Brian Brock <bbrock>
Severity: low Docs Contact:
Priority: medium    
Version: 4.0CC: jbaron, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=low,public=20051015
Fixed In Version: RHBA-2007-0304 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2007-05-01 23:55:09 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
updated patch
none
patch in FC-5 kdb package none

Description Mark J. Cox 2005-11-03 10:53:15 UTC
"The VT implementation (vt_ioctl.c) allows local users to use certain IOCTLs on
terminals of other users and gain privileges, as demonstrated by modifying key
bindings using loadkeys"

Thread here:
http://www.gossamer-threads.com/lists/linux/kernel/580641

Committed upstream fix to allow only root to use setkeys:       
http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0b360adbdb54d5b98b78d57ba0916bc4b8871968

Comment 1 Aristeu Rozanski 2006-05-10 19:16:44 UTC
Created attachment 128857 [details]
updated patch

updated patch based on e3f17f0f6e98f58edb13cb38810d93e6d4808e68 commit

Comment 2 Aristeu Rozanski 2006-05-11 11:45:59 UTC
ok, tested it on RHEL4 but it seems to break initscripts package assumption
(/etc/profile.d/lang.sh) of an user being able to load keymaps. probably this
fix is already on Fedora, so I'll take a look how they fixed this.


Comment 3 Aristeu Rozanski 2006-05-11 13:33:00 UTC
the fix done in fedora was to add 'kbd-1.12-no-user-map.patch' patch to kbd
package, that I'll add here just for reference


Comment 4 Aristeu Rozanski 2006-05-11 13:56:55 UTC
Created attachment 128887 [details]
patch in FC-5 kdb package

time to check if this fits on U5 or will have to wait until RHEL-5

Comment 10 RHEL Program Management 2006-09-07 19:35:57 UTC
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.

Comment 11 RHEL Program Management 2006-09-07 19:35:58 UTC
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.

Comment 12 RHEL Program Management 2006-09-07 19:36:26 UTC
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.

Comment 14 Jason Baron 2006-10-03 17:09:28 UTC
committed in stream U5 build 42.15. A test kernel with this patch is available
from http://people.redhat.com/~jbaron/rhel4/


Comment 17 Red Hat Bugzilla 2007-05-01 23:55:09 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2007-0304.html