Created attachment 115326 [details] close another path to the same hole Aargh! David Mosberger e-mailed me last night with a concern that Matt's fix only closed one code path that allowed ar.rsc to be set. He's right. Here's my attempt at closing the ptrace_setregs() path too. Fresh out of the tree. Untested (apart from that it compiles). No reviews yet either.
I have an ACK from David Mosberger that the new patch is OK.
But now Chris Wright has pointed out that restore_sigcontext() will also load an arbitrary value into ar.rsc from userspace. So I'm stopping trying to rush this into 2.6.12. It will go into 2.6.12.y.
Created attachment 115375 [details] Fix restore_sigcontext() path too This should be the final version. If there are no problems with it, then I will release this on Wed June 22nd at noon PDT.
commit from 2.6.12 stable: http://www.kernel.org/git/?p=linux/kernel/git/gregkh/linux-2.6.12.y.git;a=commitdiff;h=df0112ae92e768bda81105cff85d7c8e46004d7b
CAN-2005-1761 ptrace crasher HP reported via Intel a way that on ia64 a local user could write to the pl field via ptrace and therefore read/write kernel memory.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2005-514.html