Bug 1208598 (CVE-2015-2830) - CVE-2015-2830 kernel: int80 fork from 64-bit tasks mishandling
Summary: CVE-2015-2830 kernel: int80 fork from 64-bit tasks mishandling
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2015-2830
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1208599 1209231 1209232 1209233 1209234 1209235 1209236 1210304 1210305 1223657
Blocks: 1208595
TreeView+ depends on / blocked
 
Reported: 2015-04-02 15:59 UTC by Vasyl Kaigorodov
Modified: 2021-02-17 05:27 UTC (History)
25 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A flaw was found in the way the Linux kernel's 32-bit emulation implementation handled forking or closing of a task with an 'int80' entry. A local user could potentially use this flaw to escalate their privileges on the system.
Clone Of:
Environment:
Last Closed: 2017-08-08 05:24:27 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:1137 0 normal SHIPPED_LIVE Important: kernel security and bug fix update 2015-06-23 12:46:59 UTC
Red Hat Product Errata RHSA-2015:1138 0 normal SHIPPED_LIVE Important: kernel-rt security, bug fix, and enhancement update 2015-06-23 12:28:04 UTC
Red Hat Product Errata RHSA-2015:1139 0 normal SHIPPED_LIVE Important: kernel-rt security, bug fix, and enhancement update 2015-06-23 12:24:45 UTC
Red Hat Product Errata RHSA-2015:1221 0 normal SHIPPED_LIVE Moderate: kernel security, bug fix, and enhancement update 2015-07-14 19:12:10 UTC

Description Vasyl Kaigorodov 2015-04-02 15:59:25 UTC
Linux kernel built with the 32-bit emulation support(CONFIG_IA32_EMULATION), is vulnerable to potential privilege escalation flaw. This could occur while calling fork(2) & close(2) system calls with an 'int80' entry, which results in an inappropriate task state in the child process.

An unprivileged user could potentially use this flaw to overcome certain kernel enforced and intended limitations such as seccomp policy and thus increase their privileges on the system.

Upstream fix:
-------------
  -> https://git.kernel.org/linus/956421fbb74c3a6261903f3836c0740187cf038b

Reference:
----------
  -> http://seclists.org/oss-sec/2015/q2/8

Comment 1 Vasyl Kaigorodov 2015-04-02 16:01:09 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1208599]

Comment 2 Josh Boyer 2015-04-02 17:21:08 UTC
(In reply to Vasyl Kaigorodov from comment #1)
> Created kernel tracking bugs for this issue:
> 
> Affects: fedora-all [bug 1208599]

The above commit was backported to 3.19.2 with commit 1f4d987805f78ddbc03cd901eed43aeb60ee344a.  All Fedora branches are on 3.19.3 or newer.

Comment 5 Prasad Pandit 2015-04-07 07:02:55 UTC
Statement:

This issue affects the versions of the Linux kernel as shipped with
Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2. Future kernel updates for the respective releases may address this issue.

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and
maintenance life cycle. This has been rated as having Low security
impact and is not currently planned to be addressed in future updates. For
additional information, refer to the Red Hat Enterprise Linux Life
Cycle: https://access.redhat.com/support/policy/updates/errata/.

Comment 10 errata-xmlrpc 2015-06-23 08:26:04 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:1139 https://rhn.redhat.com/errata/RHSA-2015-1139.html

Comment 11 errata-xmlrpc 2015-06-23 08:29:23 UTC
This issue has been addressed in the following products:

  MRG for RHEL-6 v.2

Via RHSA-2015:1138 https://rhn.redhat.com/errata/RHSA-2015-1138.html

Comment 12 errata-xmlrpc 2015-06-23 08:48:41 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:1137 https://rhn.redhat.com/errata/RHSA-2015-1137.html

Comment 14 errata-xmlrpc 2015-07-14 15:14:19 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2015:1221 https://rhn.redhat.com/errata/RHSA-2015-1221.html

Comment 15 Carl Song 2017-08-04 19:19:35 UTC
https://access.redhat.com/security/cve/CVE-2015-2830 still lists RHEL 5 as affected. Considering RHEL 5 is now EOL. Should this issue be closed?

Comment 16 Wade Mealing 2017-08-07 01:20:17 UTC
Red Hat Enterprise Linux 5 is not end of life yet, it is currently in Extended Life Phase. For more information please see https://access.redhat.com/support/policy/updates/errata .

From what i'm reading about internal notes though this could be closed, going to needinfo the reporter specifically to get an answer.

Comment 17 Prasad Pandit 2017-08-08 05:23:50 UTC
(In reply to Wade Mealing from comment #16)
> From what i'm reading about internal notes though this could be closed,
> going to needinfo the reporter specifically to get an answer.

Yes, considering it is rated low impact and rhel-5 fix was deferred owing to it being close to its EOL and all other trackers are closed, we can close it.


Note You need to log in before you can comment on or make changes to this bug.