Bug 607038

Summary:	kernel: thinkpad-acpi: lock down video output state access [mrg-1]
Product:	Red Hat Enterprise MRG	Reporter:	Eugene Teo (Security Response) <eteo>
Component:	realtime-kernel	Assignee:	Red Hat Real Time Maintenance <rt-maint>
Status:	CLOSED WONTFIX	QA Contact:	David Sommerseth <davids>
Severity:	medium	Docs Contact:
Priority:	high
Version:	1.2	CC:	bhu, eteo, lgoncalv, lwang, ovasik, williams
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:	607035	Environment:
Last Closed:	2010-07-08 19:53:34 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	607035, 607039
Bug Blocks:	607037, 652122

Description Eugene Teo (Security Response) 2010-06-23 02:25:42 UTC

+++ This bug was initially created as a clone of Bug #607035 +++

Description of problem:
Given the right combination of ThinkPad and X.org, just reading the video output control state is enough to hard-crash X.org.
    
Until the day I somehow find out a model or BIOS cut date to not provide this feature to ThinkPads that can do video switching through X RandR, change permissions so that only processes with CAP_SYS_ADMIN can access any sort of video output control state.
    
This bug could be considered a local DoS I suppose, as it allows any non-privledged local user to cause some versions of X.org to hard-crash some ThinkPads.
    
Reported-by: Jidanni <jidanni>
Signed-off-by: Henrique de Moraes Holschuh <hmh.br>
Cc: stable

Upstream commit:
http://git.kernel.org/linus/b525c06cdbd8a3963f0173ccd23f9147d4c384b5

Comment 3 Clark Williams 2010-07-08 19:53:34 UTC

Thinkpads are not target platforms for MRG RT.

Comment 4 Eugene Teo (Security Response) 2010-07-09 00:04:45 UTC

Thanks Clark.