| Summary: | CVE-2010-3066 kernel: io_submit_one() NULL ptr deref | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Eugene Teo (Security Response) <eteo> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | dhoward, jmoyer, jolsa, plyons, pmatouse, rkhan, vdanen, vgoyal |
| Target Milestone: | --- | Keywords: | Reopened, Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-10-19 09:14:02 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Bug Depends On: | Engineering631718, Engineering631719, Engineering631720, Engineering631721 | ||
| Bug Blocks: | |||
Acknowledgements: Red Hat would like to thank Tavis Ormandy for reporting this issue. The aio eventfd patches weren't backported to RHEL 4, so this bug doesn't exist on RHEL 4 at all. (In reply to comment #4) > The aio eventfd patches weren't backported to RHEL 4, so this bug doesn't exist > on RHEL 4 at all. That's certainly nice, but still this bug exists for rhel5 and as this bz is the root bug, closing it with NOTABUG is just bogus -> Setting state to ASSIGNED. This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2010:0839 https://rhn.redhat.com/errata/RHSA-2010-0839.html Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 3 and 4 as they did not include support for eventfd in the Async I/O (AIO) implementation. It did not affect the version of Linux kernel as shipped with Red Hat Enterprise MRG as it has already had the fix to this issue. This issue was addressed in Red Hat Enterprise Linux 5 via https://rhn.redhat.com/errata/RHSA-2010-0839.html |
Description of problem: Missing backport patch: commit 87e2831c3fa39cbf6f7ab676bb5aef039b9659e2 Author: Yan Zheng <yanzheng> Date: Mon Oct 8 12:16:20 2007 -0700 AIO: fix cleanup in io_submit_one(...) When IOCB_FLAG_RESFD flag is set and iocb->aio_resfd is incorrect, statement 'goto out_put_req' is executed. At label 'out_put_req', aio_put_req(..) is called, which requires 'req->ki_filp' set. Upstream patch: http://git.kernel.org/linus/87e2831c3fa39cbf6f7ab676bb5aef039b9659e2