Bug 245580
| Summary: | CVE-2007-3107 Data buffer miscompare on PowerPC when running HTX | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 5 | Reporter: | Ludek Smid <lsmid> |
| Component: | kernel | Assignee: | Don Howard <dhoward> |
| Status: | CLOSED ERRATA | QA Contact: | Martin Jenner <mjenner> |
| Severity: | medium | Docs Contact: | |
| Priority: | urgent | ||
| Version: | 5.1 | CC: | dzickus, jturner, konradr, marcobillpeter, peterm, security-response-team, smoser, tao |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | ppc64 | ||
| OS: | Linux | ||
| Whiteboard: | impact=moderate,source=redhat,reported=20070622,public=20070703 | ||
| Fixed In Version: | RHSA-2007-0595 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2007-07-10 04:04:28 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 245332 | ||
| Bug Blocks: | |||
|
Description
Ludek Smid
2007-06-25 15:13:15 UTC
Konrad, Any update on the status of IBM testing on with the 2.6.18-8.1.8.el5 kernel ? Testing of 2.6.18-8.1.8.el5 passed the HTX test-suite successfully. We think that we are getting a page fault or timer interrupt during one of the __copy_from_user calls in restore_sigcontext - the ones that write to current->thread.fpr and current->thread.vr. Since we aren't clearing MSR_FP and MSR_VEC until after the copy, switching to another process during the copy will overwrite current->thread.fpr (assuming the signal handler used floating-point instructions). If we clear those MSR bits before copying into current->thread.fpr and/or current->thread.vr, like the 32-bit code already does, we are safe -- and that's what we will do with this patch. The bad news is that this bug was introduced in 2.6.2, so it is present in RHEL4, SLES9 and SLES10 as well... An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2007-0595.html |