Bug 647416 (CVE-2010-3865)

Summary:	CVE-2010-3865 kernel: iovec integer overflow in net/rds/rdma.c
Product:	[Other] Security Response	Reporter:	Eugene Teo (Security Response) <eteo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	arozansk, davej, dhoward, fhrbata, jpirko, kmcmartin, lwang, nixon, plyons, pmatouse, rcvalle, security-response-team, tcallawa, vdanen
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-03-28 08:44:42 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	647421, 647422, 647423, 647424
Bug Blocks:

Comment 1 Eugene Teo (Security Response) 2010-10-28 09:53:50 UTC

As reported by Thomas Pollet, the rdma page counting can overflow.  We get the rdma sizes in 64-bit unsigned entities, but then limit it to UINT_MAX bytes and shift them down to pages (so with a possible "+1" for an unaligned address). 

So each individual page count fits comfortably in an 'unsigned int' (not even close to overflowing into signed), but as they are added up, they might end up resulting in a signed return value. Which would be wrong.

Catch the case of tot_pages turning negative, and return the appropriate error code.

http://www.spinics.net/lists/netdev/msg145359.html
http://www.spinics.net/lists/netdev/msg145397.html

Introduced in commit eff5f53bef75c0864a5da06bb688939092b848dc (v2.6.30-rc1)

Acknowledgements:

Red Hat would like to thank Thomas Pollet for reporting this issue.

Comment 3 Eugene Teo (Security Response) 2010-10-28 09:57:41 UTC

Statement:

The Linux kernel as shipped with Red Hat Enterprise Linux 3, 4 and Red Hat
Enterprise MRG did not include support for the RDS Protocol, and therefore are
not affected by this issue. Future kernel updates in Red Hat Enterprise Linux 5
may address this flaw.

Mitigation:

For users that do not run applications that use RDS, you can prevent the rds
module from being loaded by adding the following entry to the end of the
/etc/modprobe.d/blacklist file:

blacklist rds

This way, the rds module cannot be loaded accidentally, which may occur if an
application that requires RDS is started. A reboot is not necessary for this
change to take effect but do make sure the module is not loaded in the first
place. You can verify that by running:

lsmod | grep rds

You may also consider removing the CAP_SYS_MODULE capability from the current
global capability set to prevent kernel modules from being loaded or unloaded.
The CAP_SYS_MODULE has a capability number of 16 (see linux/capability.h). The
default value has all the bits set. To remove this capability, you have to
clear the 16th bit of the default 32-bit value, e.g. 0xffffff ^ (1 << 16):

echo 0xFFFEFFFF > /proc/sys/kernel/cap-bound

Comment 6 Eugene Teo (Security Response) 2010-11-10 11:00:44 UTC

Upstream commit:
http://git.kernel.org/linus/1b1f693d7ad6d193862dcb1118540a030c5e761f

Comment 12 errata-xmlrpc 2011-01-04 16:52:49 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2011:0004 https://rhn.redhat.com/errata/RHSA-2011-0004.html

Comment 13 errata-xmlrpc 2011-01-11 19:45:10 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:0007 https://rhn.redhat.com/errata/RHSA-2011-0007.html