Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

For bugs related to Red Hat Enterprise Linux 5 product line. The current stable release is 5.10. For Red Hat Enterprise Linux 6 and above, please visit Red Hat JIRA https://issues.redhat.com/secure/CreateIssue!default.jspa?pid=12332745 to report new issues.

Bug 229885

Summary:	CVE-2007-0958 core-dumping unreadable binaries via PT_INTERP
Product:	Red Hat Enterprise Linux 5	Reporter:	Linda Wang <lwang>
Component:	kernel	Assignee:	Don Howard <dhoward>
Status:	CLOSED ERRATA	QA Contact:	Brian Brock <bbrock>
Severity:	low	Docs Contact:
Priority:	medium
Version:	5.0	CC:	dzickus, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	impact=low,source=vendorsec,reported=20060808,public=20070126
Fixed In Version:	RHSA-2007-0099	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-03-14 15:05:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Linda Wang 2007-02-23 23:07:47 UTC

+++ This bug was initially created as a clone of Bug #228886 +++

CVE-2004-1073 is still an issue -- PoC can still cause a coredump of a
non-readable binary such as /usr/bin/sudo; PoC attached; the tweak is question
is adding:

  eph.p_memsz = 4097;

Run "./poc /usr/bin/sudo" and a "core" spits out -- WFM on a 2.6.17.x kernel.

-- Additional comment from holtmann on 2007-02-15 14:07 EST --
Created an attachment (id=148136)
Proposed upstream patch


-- Additional comment from pm-rhel on 2007-02-23 14:04 EST --
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.

-- Additional comment from jturner on 2007-02-23 14:05 EST --
QE ack for RHEL5.

Comment 2 Don Howard 2007-02-27 01:28:30 UTC

A patch addressing this issue is included in build 2.6.18-8.1.1.el5.

Comment 10 Mike Gahagan 2007-03-06 23:24:58 UTC


ok, with that change I can now reproduce the problem and have sucessfully tested
the fix on i686 and x86_64 (using a 32-bit poc and sudo binary)

Comment 12 Red Hat Bugzilla 2007-03-14 15:05:15 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2007-0099.html