http://linux.bkbits.net:8080/linux-2.6/cset@4401eb1byTR_y2KtLU4V7RCcTlhdgw "[PATCH] x86_64: Check for bad elf entry address. Fixes a local DOS on Intel systems that lead to an endless recursive fault. AMD machines don't seem to be affected."
Comment #5 From Ernie Petrides (petrides) on 2006-03-09 17:22 EST Created an attachment (id=125908) [edit] patch posted for internal review today to address this The attached patch addresses all known vulnerabilities of EM64T cpus returning to user-space at non-canonical RIP values. Comment #6 From Mark J. Cox (Security Response Team) (mjc) on Whilst fixing a fix for invalid ELF Ernie discovered signal catching is still vulnerable, with a trivial test case causing a double-fault on EM64T-based systems. Allocated CVE-2006-0744. The patch above addresses CVE-2006-0741 and CVE-2006-0744
Upstream commits are here: http://marc.theaimsgroup.com/?l=git-commits-head&m=114097681403026&w=2 http://marc.theaimsgroup.com/?l=git-commits-head&m=114223318030280&w=2
The 2nd upstream commit listed above has been found to cause regressions and has been reverted by Linus yesterday. I've decided to port the RHEL3 patch from bug 183492 comment #5 instead.
Created attachment 126179 [details] patch posted for internal review today to address this The attached patch addresses all known vulnerabilities of EM64T cpus returning to user-space at non-canonical RIP values.
Created attachment 127095 [details] revised patch posted for internal re-review tonight This updated version of the patch in comment #9 addresses a regression in the RIP validation check introduced in restore_sigcontext(). The x86_64 "vsyscall" region must be excluded from the invalid addr range.
committed in stream U4 build 34.12. A test kernel with this patch is available from http://people.redhat.com/~jbaron/rhel4/
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2006-0493.html
*** Bug 186925 has been marked as a duplicate of this bug. ***