Bug 144153 - [kernel-unsupported] binfmt_aout DoS
[kernel-unsupported] binfmt_aout DoS
Status: CLOSED DUPLICATE of bug 144361
Product: Red Hat Enterprise Linux 3
Classification: Red Hat
Component: kernel (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Dave Anderson
Brian Brock
: Security
Depends On:
  Show dependency treegraph
Reported: 2005-01-04 16:06 EST by Josh Bressers
Modified: 2007-11-30 17:07 EST (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2005-05-23 20:06:18 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Josh Bressers 2005-01-04 16:06:25 EST
Marcelo Tosatti brought this to the attention of vendor-sec

The recent binfmt_aout v2.6 backport changes also fix a DoS:

ChangeSet@1.1527.1.13, 2004-12-16 16:06:31-02:00, chrisw@osdl.org
  [PATCH] a.out: error check on set_brk

  It's possible for do_brk() to fail during set_brk() when exec'ing and
  a.out.  This was noted with Florian's a.out binary and overcommit set to

  Capture this error and terminate properly.

ChangeSet@1.1527.1.16, 2004-12-17 21:45:58-02:00, chrisw@osdl.org
  [PATCH] Backport of 2.6 fix to insert_vm_struct to make it return an error
rather than BUG().

  Backport of 2.6 fix to insert_vm_struct to make it return an error
  rather than BUG().  This eliminates a user triggerable BUG() when user
  created a large vma that overlapped with arg pages during exec (could be
  triggered with a.out on i386 and x86_64 and elf on ia64).

  Signed-off-by: Chris Wright <chrisw@osdl.org>
Comment 1 Ernie Petrides 2005-01-04 17:06:38 EST
While I agree that we should fix such a problem in RHEL3, support for
a.out format binaries is disabled by default (in RHEL3), and thus users
cannot crash RHEL3 kernels over a.out handling bugs under normal circumstances.

Lowering priority to NORMAL.
Comment 3 Ernie Petrides 2005-05-23 20:06:18 EDT
I've determined that this was fixed in U5 (in kernel version 2.4.21-27.8.EL)
as well as in the 2nd E5 build (in kernel version 2.4.21-27.0.2.EL).  Here
is the comment associated with the release of that E5 advisory:

"An advisory has been issued which should help the problem
 described in this bug report. This report is therefore being
 closed with a resolution of ERRATA. For more information
 on the solution and/or where to find the updated files,
 please follow the link below. You may reopen this bug report
 if the solution does not work for you.


Obviously, we'd rather have people upgrade to U5 at this point,
which was released with advisory RHSA-2005:294.

*** This bug has been marked as a duplicate of 144361 ***

Note You need to log in before you can comment on or make changes to this bug.