Bug 228816

Summary: CVE-2007-0771 utrace regression / denial of service
Product: Red Hat Enterprise Linux 5 Reporter: Marcel Holtmann <holtmann>
Component: kernelAssignee: Roland McGrath <roland>
Status: CLOSED ERRATA QA Contact: Brian Brock <bbrock>
Severity: high Docs Contact:
Priority: urgent    
Version: 5.0CC: dhoward, dzickus, security-response-team, syeghiay
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=important,source=lkml,reported=20070212,public=20070212
Fixed In Version: RHSA-2007-0169 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2007-04-30 16:36:53 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 229886    
Attachments:
Description Flags
fix for utrace/ptrace leak and crash bugs with MT exec
none
modified test program
none
fix for utrace/ptrace leak and crash bugs with MT exec + utrace_attach spin failure mode none

Description Marcel Holtmann 2007-02-15 09:57:41 UTC
It is possible to render a system with utrace support unusable in ~10 seconds
(but not mainline kernel where Ctrl+C will kill process).

Comment 7 Roland McGrath 2007-03-07 11:20:32 UTC
Created attachment 149446 [details]
fix for utrace/ptrace leak and crash bugs with MT exec

This fixes both OOM and BUG_ON failure modes and another crash failure mode
from the same problem.	I can't reproduce any problems in the test case after
this patch, where I got all three failure modes before.

Comment 11 Roland McGrath 2007-03-07 19:40:38 UTC
Created attachment 149481 [details]
modified test program

Here is the version of the test I have been using.
It prints out some more info, but not so much that it perturbed the behavior
for me.

Comment 12 Roland McGrath 2007-03-08 02:14:02 UTC
Fedora bug 227952 is the same problems as this.

Comment 13 Roland McGrath 2007-03-08 03:10:44 UTC
Created attachment 149546 [details]
fix for utrace/ptrace leak and crash bugs with MT exec + utrace_attach spin failure mode

This includes an additional fix that I think resolves a failure mode where
utrace_attach spins when you try to kill the test with SIGKILL.

Comment 23 Don Howard 2007-03-29 21:41:51 UTC
A patch for this issue has been included in zstream build 2.6.18-8.1.2.el5.

Comment 26 Mike Gahagan 2007-04-26 22:04:33 UTC
fix verified on an x86_64 test system, I had to run 3 concurrent copies of
ptrace_thrash to reproduce the problem initially.


Comment 28 Red Hat Bugzilla 2007-04-30 16:36:54 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2007-0169.html