Bug 159671 - CAN-2005-1761 local user can use ptrace to crash system
CAN-2005-1761 local user can use ptrace to crash system
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: kernel (Show other bugs)
4.0
ia64 Linux
medium Severity high
: ---
: ---
Assigned To: Jason Baron
Brian Brock
reported=20050607,impact=important,so...
: Security
Depends On:
Blocks: 156322
  Show dependency treegraph
 
Reported: 2005-06-06 15:42 EDT by Tony Luck
Modified: 2013-03-06 00:58 EST (History)
3 users (show)

See Also:
Fixed In Version: RHSA-2005-514
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2005-10-05 09:22:42 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
patch from Matt Chapman (1.26 KB, patch)
2005-06-07 12:10 EDT, Tony Luck
no flags Details | Diff
close another path to the same hole (1.91 KB, patch)
2005-06-11 12:56 EDT, Tony Luck
no flags Details | Diff
Fix restore_sigcontext() path too (3.13 KB, patch)
2005-06-13 17:15 EDT, Tony Luck
no flags Details | Diff

  None (edit)
Comment 6 Tony Luck 2005-06-11 12:56:40 EDT
Created attachment 115326 [details]
close another path to the same hole

Aargh!	David Mosberger e-mailed me last night with a concern that Matt's fix
only closed one code path that allowed ar.rsc to be set.  He's right.

Here's my attempt at closing the ptrace_setregs() path too.  Fresh out of the
tree.  Untested (apart from that it compiles).	No reviews yet either.
Comment 7 Tony Luck 2005-06-11 15:36:30 EDT
I have an ACK from David Mosberger that the new patch is OK.
Comment 8 Tony Luck 2005-06-11 19:34:29 EDT
But now Chris Wright has pointed out that restore_sigcontext() will also load 
an arbitrary value into ar.rsc from userspace.  So I'm stopping trying to rush 
this into 2.6.12.  It will go into 2.6.12.y.
Comment 9 Tony Luck 2005-06-13 17:15:42 EDT
Created attachment 115375 [details]
Fix restore_sigcontext() path too

This should be the final version.  If there are no problems with it, then I
will release this on Wed June 22nd at noon PDT.
Comment 11 Mark J. Cox (Product Security) 2005-06-27 07:40:14 EDT
CAN-2005-1761 ptrace crasher
        HP reported via Intel a way that on ia64 a local user could
        write to the pl field via ptrace and therefore read/write
        kernel memory.
Comment 19 Red Hat Bugzilla 2005-10-05 09:22:42 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2005-514.html

Note You need to log in before you can comment on or make changes to this bug.