Bug 159671 - CAN-2005-1761 local user can use ptrace to crash system
Summary: CAN-2005-1761 local user can use ptrace to crash system
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: kernel
Version: 4.0
Hardware: ia64
OS: Linux
medium
high
Target Milestone: ---
: ---
Assignee: Jason Baron
QA Contact: Brian Brock
URL:
Whiteboard: reported=20050607,impact=important,so...
Depends On:
Blocks: 156322
TreeView+ depends on / blocked
 
Reported: 2005-06-06 19:42 UTC by Tony Luck
Modified: 2013-03-06 05:58 UTC (History)
3 users (show)

Fixed In Version: RHSA-2005-514
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2005-10-05 13:22:42 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)
patch from Matt Chapman (1.26 KB, patch)
2005-06-07 16:10 UTC, Tony Luck
no flags Details | Diff
close another path to the same hole (1.91 KB, patch)
2005-06-11 16:56 UTC, Tony Luck
no flags Details | Diff
Fix restore_sigcontext() path too (3.13 KB, patch)
2005-06-13 21:15 UTC, Tony Luck
no flags Details | Diff


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2005:514 0 qe-ready SHIPPED_LIVE Important: Updated kernel packages available for Red Hat Enterprise Linux 4 Update 2 2005-10-05 04:00:00 UTC

Comment 6 Tony Luck 2005-06-11 16:56:40 UTC
Created attachment 115326 [details]
close another path to the same hole

Aargh!	David Mosberger e-mailed me last night with a concern that Matt's fix
only closed one code path that allowed ar.rsc to be set.  He's right.

Here's my attempt at closing the ptrace_setregs() path too.  Fresh out of the
tree.  Untested (apart from that it compiles).	No reviews yet either.

Comment 7 Tony Luck 2005-06-11 19:36:30 UTC
I have an ACK from David Mosberger that the new patch is OK.

Comment 8 Tony Luck 2005-06-11 23:34:29 UTC
But now Chris Wright has pointed out that restore_sigcontext() will also load 
an arbitrary value into ar.rsc from userspace.  So I'm stopping trying to rush 
this into 2.6.12.  It will go into 2.6.12.y.

Comment 9 Tony Luck 2005-06-13 21:15:42 UTC
Created attachment 115375 [details]
Fix restore_sigcontext() path too

This should be the final version.  If there are no problems with it, then I
will release this on Wed June 22nd at noon PDT.

Comment 11 Mark J. Cox 2005-06-27 11:40:14 UTC
CAN-2005-1761 ptrace crasher
        HP reported via Intel a way that on ia64 a local user could
        write to the pl field via ptrace and therefore read/write
        kernel memory.


Comment 19 Red Hat Bugzilla 2005-10-05 13:22:42 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2005-514.html



Note You need to log in before you can comment on or make changes to this bug.