Bug 245580 - CVE-2007-3107 Data buffer miscompare on PowerPC when running HTX
Summary: CVE-2007-3107 Data buffer miscompare on PowerPC when running HTX
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: kernel   
(Show other bugs)
Version: 5.1
Hardware: ppc64 Linux
Target Milestone: ---
: ---
Assignee: Don Howard
QA Contact: Martin Jenner
Whiteboard: impact=moderate,source=redhat,reporte...
Keywords: Security
Depends On: 245332
TreeView+ depends on / blocked
Reported: 2007-06-25 15:13 UTC by Ludek Smid
Modified: 2009-06-19 23:02 UTC (History)
8 users (show)

Fixed In Version: RHSA-2007-0595
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2007-07-10 04:04:28 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2007:0595 normal SHIPPED_LIVE Moderate: kernel security and bug fix update 2007-07-10 04:04:17 UTC

Description Ludek Smid 2007-06-25 15:13:15 UTC
This bug has been copied from bug #245332 and has been proposed to be backported
to 5.0 z-stream (EUS).

Comment 3 Martin Jenner 2007-07-05 19:13:20 UTC

Any update on the status of IBM testing on with the 2.6.18-8.1.8.el5 kernel ?

Comment 4 Konrad Rzeszutek 2007-07-05 20:07:59 UTC
Testing of 2.6.18-8.1.8.el5 passed the  HTX test-suite successfully.

Comment 7 Marcel Holtmann 2007-07-10 03:35:34 UTC
We think that we are getting a page fault or timer interrupt during one of the
__copy_from_user calls in restore_sigcontext - the ones that write to
current->thread.fpr and current->thread.vr.  Since we aren't clearing MSR_FP
and MSR_VEC until after the copy, switching to another process during the copy
will overwrite current->thread.fpr (assuming the signal handler used
floating-point instructions).  If we clear those MSR bits before copying into
current->thread.fpr and/or current->thread.vr, like the 32-bit code already
does, we are safe -- and that's what we will do with this patch.
The bad news is that this bug was introduced in 2.6.2, so it is present in
RHEL4, SLES9 and SLES10 as well...

Comment 8 Red Hat Bugzilla 2007-07-10 04:04:28 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.