Bug 652122 (CVE-2010-3448)

Summary:	CVE-2010-3448 kernel: thinkpad-acpi: lock down video output state access
Product:	[Other] Security Response	Reporter:	Eugene Teo (Security Response) <eteo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	kernel-mgr, vkrizan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	public=20100226,reported=20100622,source=internet,impact=moderate,cvss2=4/AV:L/AC:H/Au:N/C:N/I:N/A:C,rhel-5/kernel=affected,rhel-6/kernel=affected,mrg-1/realtime-kernel=affected
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-07-29 10:48:43 EDT	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---
Bug Depends On:	604608, 607037, 607038, 607039, 629241, 652123
Bug Blocks:

Description Eugene Teo (Security Response) 2010-11-10 22:06:55 EST

Given the right combination of ThinkPad and X.org, just reading the video
output control state is enough to hard-crash X.org.

Until the day I somehow find out a model or BIOS cut date to not provide this
feature to ThinkPads that can do video switching through X RandR, change
permissions so that only processes with CAP_SYS_ADMIN can access any sort of
video output control state.

This bug could be considered a local DoS I suppose, as it allows any
non-privledged local user to cause some versions of X.org to hard-crash some
ThinkPads.

Reported-by: Jidanni <jidanni@jidanni.org>
Signed-off-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
Cc: stable@kernel.org

Upstream commit:
http://git.kernel.org/linus/b525c06cdbd8a3963f0173ccd23f9147d4c384b5