Bug 714761 (CVE-2011-2479)

Summary:	CVE-2011-2479 kernel: thp: madvise on top of /dev/zero private mapping can lead to panic
Product:	[Other] Security Response	Reporter:	Petr Matousek <pmatouse>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:	Zhang Kexin <kzhang>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	arozansk, bhu, dhoward, fhrbata, jkacur, kernel-mgr, kmcmartin, kzhang, lgoncalv, lwang, nobody, plougher, rkhan, rt-maint, sforsber, tcallawa, vgoyal, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-07-29 12:48:54 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:	690444, 714762
Bug Blocks:

Description Petr Matousek 2011-06-20 16:04:31 UTC

Description of problem:
The huge_memory.c THP page fault was allowed to run if vm_ops was null (which would succeed for /dev/zero MAP_PRIVATE, as the f_op->mmap wouldn't setup a special vma->vm_ops and it would fallback to regular anonymous memory) but other THP logics weren't fully activated for vmas with vm_file not NULL (/dev/zero has a not NULL vma->vm_file).

Unprivileged local user could use this flaw to crash the server.

Upstream patch: 78f11a255749d09025f54d4e2df4fbcb031530e2

References:
https://bugzilla.kernel.org/show_bug.cgi?id=33682
http://www.spinics.net/lists/stable-commits/msg11762.html

Comment 2 Petr Matousek 2011-06-20 16:13:10 UTC

Statement:

The versions of the Linux kernel as shipped with Red Hat Enterprise Linux 4, 5, and Red Hat Enterprise MRG are not affected because they do not provide support for THP (Transparent Huge Pages). This has been addressed in Red Hat Enterprise Linux 6 via https://rhn.redhat.com/errata/RHSA-2011-0928.html.

Comment 4 Vincent Danen 2011-06-20 19:34:30 UTC

This issue was assigned the name CVE-2011-2479:

http://seclists.org/oss-sec/2011/q2/644

Comment 7 errata-xmlrpc 2011-07-12 21:13:46 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:0928 https://rhn.redhat.com/errata/RHSA-2011-0928.html