Bug 250199 (CVE-2006-0558)
| Summary: | CVE-2006-0558 ia64 crash | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Marcel Holtmann <holtmann> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | akeshava, anderson, jbaron, kzhang, lwang, lwoodman, prarit, qcai, security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | ia64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | RHSA-2007-0774 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2007-09-04 14:37:56 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Marcel Holtmann
2007-07-31 00:10:58 UTC
I did notice in an email re: this BZ, that rhel-4.5.z+ was set, but I do not see any "rhel-4.5.z" Flag box below. Shouldn't the owner of the bugzilla see that box? Anyway, after looking at the patch referenced by the last line of the problem description above, I did recall seeing Luming Yu's RHKL post of the same patch go by recently. But it would have been helpful if there had been a reference to the RHEL4.6 bugzilla that this was generated from. So just for clarification, please confirm that this is a request to backport this update to RHEL4.5?: [RHEL 4.6 PATCH] BZ 185082 CVE-2006-0558 ia64 crash http://post-office.corp.redhat.com/archives/rhkernel-list/2007-July/msg00568.html Bugzilla Bug 185082: CVE-2006-0558 ia64 crash https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=185082 Thanks, Dave Sorry -- I thought that I was the assignee... A patch addressing this issue has been included in build 2.6.9-55.0.3.EL. An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2007-0774.html for historical record, comment #1 points to a patch on an internal mailing list: --- linux-2.6.9/arch/ia64/kernel/perfmon.c.0 2007-07-18 10:44:51.000000000 +0800 +++ linux-2.6.9/arch/ia64/kernel/perfmon.c 2007-07-18 10:48:30.000000000 +0800 @@ -2267,7 +2267,7 @@ * allocate a sampling buffer and remaps it into the user address space of the task */ static int -pfm_smpl_buffer_alloc(struct task_struct *task, pfm_context_t *ctx, unsigned long rsize, void **user_vaddr) +pfm_smpl_buffer_alloc(struct task_struct *task, struct file *filp, pfm_context_t *ctx, unsigned long rsize, void **user_vaddr) { struct mm_struct *mm = task->mm; struct vm_area_struct *vma = NULL; @@ -2317,6 +2317,7 @@ * partially initialize the vma for the sampling buffer */ vma->vm_mm = mm; + vma->vm_file = filp; vma->vm_flags = VM_READ| VM_MAYREAD |VM_RESERVED; vma->vm_page_prot = PAGE_READONLY; /* XXX may need to change */ @@ -2354,6 +2355,8 @@ goto error; } + get_file(filp); + /* * now insert the vma in the vm list for the process, must be * done with mmap lock held @@ -2430,7 +2433,7 @@ } static int -pfm_setup_buffer_fmt(struct task_struct *task, pfm_context_t *ctx, unsigned int ctx_flags, +pfm_setup_buffer_fmt(struct task_struct *task, struct file *filp, pfm_context_t *ctx, unsigned int ctx_flags, unsigned int cpu, pfarg_context_t *arg) { pfm_buffer_fmt_t *fmt = NULL; @@ -2471,7 +2474,7 @@ /* * buffer is always remapped into the caller's address space */ - ret = pfm_smpl_buffer_alloc(current, ctx, size, &uaddr); + ret = pfm_smpl_buffer_alloc(current, filp, ctx, size, &uaddr); if (ret) goto error; /* keep track of user address of buffer */ @@ -2682,7 +2685,7 @@ * does the user want to sample? */ if (pfm_uuid_cmp(req->ctx_smpl_buf_id, pfm_null_uuid)) { - ret = pfm_setup_buffer_fmt(current, ctx, ctx_flags, 0, req); + ret = pfm_setup_buffer_fmt(current, filp, ctx, ctx_flags, 0, req); if (ret) goto buffer_error; } |