Bug 526788 (CVE-2009-2910)

Summary: CVE-2009-2910 kernel: x86_64 32 bit process register leak
Product: [Other] Security Response Reporter: Josh Bressers <bressers>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bhu, davej, dhoward, jkacur, jolsa, jpirko, jskrabal, kyle, lgoncalv, lwang, pmatouse, tcallawa, vgoyal, williams
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 531542 (view as bug list) Environment:
Last Closed: 2012-03-28 08:54:32 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 526793, 526794, 526795, 526796, 526797, 526798, 531542, 537297    
Bug Blocks:    
Attachments:
Description Flags
Upstream patch none

Description Josh Bressers 2009-10-01 19:10:19 UTC 
Created attachment 363386 [details]
Upstream patch

An information leak was discovered in the kernel where a 32-bit process running in 64-bit mode could possibly read certain 64 bit registers. Quoting the upstream commit:
http://lkml.org/lkml/2009/10/1/164

    x86: Don't leak 64-bit kernel register values to 32-bit processes

    While 32-bit processes can't directly access R8...R15, they can
    gain access to these registers by temporarily switching themselves
    into 64-bit mode.

    Therefore, registers not preserved anyway by called C functions
    (i.e. R8...R11) must be cleared prior to returning to user mode.
Comment 4 Chuck Ebbert 2009-10-06 12:02:21 UTC 
Official upstream commit:
http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=24e35800cdc4350fc34e2bed37b
Comment 8 Fedora Update System 2009-10-15 00:21:25 UTC 
kernel-2.6.27.37-170.2.104.fc10 has been submitted as an update for Fedora 10.
http://admin.fedoraproject.org/updates/kernel-2.6.27.37-170.2.104.fc10
Comment 9 Fedora Update System 2009-10-15 22:37:12 UTC 
kernel-2.6.27.37-170.2.104.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Fedora Update System 2009-10-18 01:57:46 UTC 
kernel-2.6.30.9-90.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/kernel-2.6.30.9-90.fc11
Comment 11 Fedora Update System 2009-10-27 06:47:58 UTC 
kernel-2.6.30.9-90.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 13 errata-xmlrpc 2009-11-03 18:21:37 UTC 
This issue has been addressed in following products:

  MRG for RHEL-5

Via RHSA-2009:1540 https://rhn.redhat.com/errata/RHSA-2009-1540.html
Comment 15 errata-xmlrpc 2009-12-15 17:18:30 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4

Via RHSA-2009:1671 https://rhn.redhat.com/errata/RHSA-2009-1671.html
Comment 16 errata-xmlrpc 2010-01-19 23:37:03 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2010:0046 https://rhn.redhat.com/errata/RHSA-2010-0046.html