Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

For bugs related to Red Hat Enterprise Linux 3 product line. The current stable release is 3.9. For Red Hat Enterprise Linux 6 and above, please visit Red Hat JIRA https://issues.redhat.com/secure/CreateIssue!default.jspa?pid=12332745 to report new issues.

Bug 126414

Summary:	CAN-2004-0415 file offset pointer signedness issues
Product:	Red Hat Enterprise Linux 3	Reporter:	Mark J. Cox <mjc>
Component:	kernel	Assignee:	Alexander Viro <aviro>
Status:	CLOSED ERRATA	QA Contact:	Brian Brock <bbrock>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	3.0	CC:	peterm, petrides, riel, tburke
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2004-08-03 22:36:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Mark J. Cox 2004-06-21 11:19:34 UTC

Embargoed until Jun29 1600 MEST

isec.pl reported on May24 file offset pointer vulnerabilities allowing
read of kernel memory.  They noted "dozens of places" with vulnerable
code and gave poc based on MTRR race.

Comment 2 Ernie Petrides 2004-06-22 00:01:04 UTC

Hi, Al.  This issue is embargoed until June 29th, but we'd like to
have a RHEL3 E3-stream security errata developed in the meantime
(which will be released before U3 is released).

Comment 4 Mark J. Cox 2004-07-23 07:47:57 UTC

Due to the complexity of the issue and fixes the embargo has been
moved, currently set at Aug 3rd at 1700 UTC

Comment 5 Ernie Petrides 2004-07-31 05:59:09 UTC

A fix for this problem has just been committed to the RHEL3 E3
patch pool (in kernel version 2.4.21-15.0.4.EL).

Comment 6 Mark J. Cox 2004-08-03 17:59:05 UTC

Errata in QA; removing embargo

Comment 7 Mark J. Cox 2004-08-03 22:36:27 UTC

An errata has been issued which should help the problem 
described in this bug report. This report is therefore being 
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files, 
please follow the link below. You may reopen this bug report 
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2004-413.html

Comment 8 Ernie Petrides 2004-08-13 03:48:28 UTC

These fixes have also been propagated to the RHEL3 U3 patch pool with
tonight's commits for the U3 respin (in kernel version 2.4.21-19.EL).