Bug 294941 (CVE-2007-3739)
Summary: | CVE-2007-3739 LTC36188-Don't allow the stack to grow into hugetlb reserved regions | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Mark J. Cox <mjc> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | urgent | ||
Version: | unspecified | CC: | kreilly |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2007-11-01 13:33:51 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 247658, 253313, 294951, 294971, 294981 | ||
Bug Blocks: |
Description
Mark J. Cox
2007-09-18 15:44:35 UTC
This CVE also affects RHEL-3 (advisory has not been filled yet). On the ppc there is in mm/mmap.c file function called "expand_stack" which has the same function as that one mentioned in the patch. This also checks first, if there is enough memory to allocate, then checks if the stack wasn't expanded by some other thread and if not, checks the address space limits. If none from these tests passes, the stack is expanded. But before this increase one yet check should be added -- if the address space we would like to allocate doesn't belong to the huge_tlb_only space. |