Bug 688021 (CVE-2011-1163)
| Summary: | CVE-2011-1163 kernel: fs/partitions: Corrupted OSF partition table infoleak | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Eugene Teo (Security Response) <eteo> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | arozansk, bhu, davej, dfeng, dhoward, jkacur, jpirko, kernel-mgr, kmcmartin, lgoncalv, lwang, rt-maint, tcallawa, williams |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-03-26 19:23:28 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 688022, 688023, 688024, 688025, 688026 | ||
| Bug Blocks: | |||
Statement: This has been addressed in Red Hat Enterprise Linux 5, 6, and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0833.html, https://rhn.redhat.com/errata/RHSA-2011-0542.html, and https://rhn.redhat.com/errata/RHSA-2011-0500.html. Red Hat Enterprise Linux 4 is now in Production 3 of the maintenance life-cycle, https://access.redhat.com/support/policy/updates/errata/, therefore the fix for this issue is not currently planned to be included in the future updates. Reporter's advisory is now available: http://www.pre-cert.de/advisories/PRE-SA-2011-02.txt Upstream commit: http://git.kernel.org/linus/1eafbfeb7bdf59cfe173304c76188f3fd5f1fd05 (In reply to comment #5) > Upstream commit: > http://git.kernel.org/linus/1eafbfeb7bdf59cfe173304c76188f3fd5f1fd05 I remember someone report a regression with this commit, we also need: http://git.kernel.org/linus/34d211a2d5df4984a35b18d8ccacbe1d10abb067 This issue has been addressed in following products: MRG for RHEL-5 Via RHSA-2011:0500 https://rhn.redhat.com/errata/RHSA-2011-0500.html This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2011:0542 https://rhn.redhat.com/errata/RHSA-2011-0542.html This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2011:0833 https://rhn.redhat.com/errata/RHSA-2011-0833.html This issue has been addressed in following products: Red Hat Enterprise Linux 6.0.Z - Server Only Via RHSA-2011:0883 https://rhn.redhat.com/errata/RHSA-2011-0883.html |
The kernel automatically evaluates partition tables of storage devices. The code for evaluating OSF partitions (in fs/partitions/osf.c) contains a bug that leaks data from kernel heap memory to userspace for certain corrupted OSF partitions. In more detail (from Kernel 2.6.37 fs/partition/osf.c): (66) for (i = 0 ; i < le16_to_cpu(label->d_npartitions); i++, partition++) { iterates from 0 to d_npartitions - 1, where d_npartitions is read from the partition table without validation and partition is a pointer to an array of at most 8 d_partitions. (70) put_partition(state, slot, (71) le32_to_cpu(partition->p_offset), (72) le32_to_cpu(partition->p_size)); adds a partition based on data referenced by partition. As partition may point beyond the partition table data structure, p_offset and p_size are read from kernel heap beyond the partition table. In some cases, put_partition logs error messages to userspace including the p_offset and p_size values. Hence, some values from kernel heap are leaked to userspace. So validate the value of d_npartitions. Reference: http://www.spinics.net/lists/mm-commits/msg82737.html Acknowledgements: Red Hat would like to thank Timo Warns for reporting this issue.