Red Hat Bugzilla – Bug 1094602
CVE-2014-0206 kernel: aio: insufficient sanitization of head in aio_read_events_ring()
Last modified: 2015-02-16 10:41:57 EST
It was found that aio_read_events_ring() function in the Linux kernel's AIO subsystem did not properly sanitize AIO ring head coming from userspace. An unprivileged local user could use this flaw to randomly disclose parts of (physical) memory belonging to kernel and/or other processes. Introduced by: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a31ad380bed817aa25f8830ad23e1a0480fef797 Upstream commits: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=edfbbf388f29 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f8567a3845ac Acknowledgements: This issue was discovered by Mateusz Guzik of Red Hat.
Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 6.
This issue has been addressed in following products: Red Hat Enterprise Linux 7 Via RHSA-2014:0786 https://rhn.redhat.com/errata/RHSA-2014-0786.html
Proposed upstream patches: https://lkml.org/lkml/2014/6/24/619 https://lkml.org/lkml/2014/6/24/623
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1112975]
The comments on the patches claim to need a separate backport for v3.10 / v3.11, although they look like they would apply cleanly. Is this true? If so, when can we expect them?
(In reply to John Kacur from comment #11) > The comments on the patches claim to need a separate backport for v3.10 / > v3.11, although they look like they would apply cleanly. Is this true? If > so, when can we expect them? They've already been posted upstream. http://www.spinics.net/lists/stable/msg51486.html http://www.spinics.net/lists/stable/msg51487.html
kernel-3.14.9-200.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in following products: MRG for RHEL-6 v.2 Via RHSA-2014:0913 https://rhn.redhat.com/errata/RHSA-2014-0913.html
kernel-3.14.13-100.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.