Bug 160200
| Summary: | CAN-2005-1768 64bit execve() race leads to buffer overflow | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 2.1 | Reporter: | Mark J. Cox <mjc> | ||||
| Component: | kernel | Assignee: | Don Howard <dhoward> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Brian Brock <bbrock> | ||||
| Severity: | high | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 2.1 | CC: | security-response-team | ||||
| Target Milestone: | --- | Keywords: | Security | ||||
| Target Release: | --- | ||||||
| Hardware: | ia64 | ||||||
| OS: | Linux | ||||||
| Whiteboard: | source=secalert,reported=20050612,impact=important,public=20050704 | ||||||
| Fixed In Version: | RHSA-2005-551 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2005-08-25 13:18:55 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 143573 | ||||||
| Attachments: |
|
||||||
Created attachment 115348 [details]
Proposed patch from Andi Kleen
Fixed in 2.4.32-pre1, therefore no need to treat as embargoed. Public 20050704 An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2005-551.html |
Reported to secalert by Ilja van Sprundel, a race condition in execve affecting x86_64 and ia64 which exists because kmalloc() or get_user() can block, and hence another thread can change the argv and envp pointers, causing a bufferoverflow (also on SMP without blocking) na = nargs(argv, NULL); ... ne = nargs(envp, NULL); ... len = (na + ne + 2) * sizeof(*av); ... av = kmalloc(len, GFP_KERNEL); ... r = nargs(argv, av); ... r = nargs(envp, ae); "the nargs() function is used to first count the amount of argv and envp pointers, next a kmalloc() is done, and then nargs() is called again to copy the argv and envp pointer into this newly allocated memory. the race condition exists because kmalloc() or get_user() can block, and hence another thread can change the argv and envp pointers, causing a buffer overflow." Currently embargoed