Bug 245580 - CVE-2007-3107 Data buffer miscompare on PowerPC when running HTX
CVE-2007-3107 Data buffer miscompare on PowerPC when running HTX
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: kernel (Show other bugs)
ppc64 Linux
urgent Severity medium
: ---
: ---
Assigned To: Don Howard
Martin Jenner
: Security
Depends On: 245332
  Show dependency treegraph
Reported: 2007-06-25 11:13 EDT by Ludek Smid
Modified: 2009-06-19 19:02 EDT (History)
8 users (show)

See Also:
Fixed In Version: RHSA-2007-0595
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2007-07-10 00:04:28 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Ludek Smid 2007-06-25 11:13:15 EDT
This bug has been copied from bug #245332 and has been proposed to be backported
to 5.0 z-stream (EUS).
Comment 3 Martin Jenner 2007-07-05 15:13:20 EDT

Any update on the status of IBM testing on with the 2.6.18-8.1.8.el5 kernel ?
Comment 4 Konrad Rzeszutek 2007-07-05 16:07:59 EDT
Testing of 2.6.18-8.1.8.el5 passed the  HTX test-suite successfully.
Comment 7 Marcel Holtmann 2007-07-09 23:35:34 EDT
We think that we are getting a page fault or timer interrupt during one of the
__copy_from_user calls in restore_sigcontext - the ones that write to
current->thread.fpr and current->thread.vr.  Since we aren't clearing MSR_FP
and MSR_VEC until after the copy, switching to another process during the copy
will overwrite current->thread.fpr (assuming the signal handler used
floating-point instructions).  If we clear those MSR bits before copying into
current->thread.fpr and/or current->thread.vr, like the 32-bit code already
does, we are safe -- and that's what we will do with this patch.
The bad news is that this bug was introduced in 2.6.2, so it is present in
RHEL4, SLES9 and SLES10 as well...
Comment 8 Red Hat Bugzilla 2007-07-10 00:04:28 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.