Bug 294541 - (CVE-2007-4573) CVE-2007-4573 x86_64 syscall vulnerability
CVE-2007-4573 x86_64 syscall vulnerability
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
x86_64 Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
impact=important,reported=20070918,pu...
: Security
Depends On: 297841 297851 297861 297871 297881
Blocks:
  Show dependency treegraph
 
Reported: 2007-09-18 07:20 EDT by Mark J. Cox (Product Security)
Modified: 2010-10-22 14:42 EDT (History)
14 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-01-17 10:38:08 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Andis proposed patch (3.15 KB, patch)
2007-09-19 06:51 EDT, Mark J. Cox (Product Security)
no flags Details | Diff

  None (edit)
Description Mark J. Cox (Product Security) 2007-09-18 07:20:45 EDT
Wojciech Purczynski of COSEINC notified us of a kernel security issue that could
lead to local privilege escalation on x86_64 platforms.

draft advisory to follow.

Acknowledgements:

Red Hat would like to thank Wojciech Purczynski for reporting this issue.
Comment 5 Mark J. Cox (Product Security) 2007-09-19 04:13:47 EDT
Note that for RHEL5 this fix probably also need to be applied to ia32entry-xen.S
created by linux-2.6-xen.patch
Comment 13 Roland McGrath 2007-09-21 17:01:25 EDT
Fix has been committed upstream (public)
Comment 15 Mark J. Cox (Product Security) 2007-09-22 03:15:01 EDT
public, removing embargo
Comment 17 Mark J. Cox (Product Security) 2007-09-24 05:56:09 EDT
Details of privilege escalation consequence now public via advisory:
http://marc.info/?l=full-disclosure&m=119062587407908&w=2

(opening up initial comment in this bug)
Comment 24 Jan Iven 2007-09-27 10:47:45 EDT
Working exploit has been made public.
Comment 25 Mark J. Cox (Product Security) 2007-09-27 11:22:18 EDT
Jan, updated kernels are progressing through quality engineering.  We'll be
releasing them (for RHEL3,4,5) the moment they pass!
Comment 28 Jan Iven 2007-09-28 10:19:05 EDT
While the Errata kernels have been announced on the enterprise-watch list 18h
ago and are available via RHN, it appears as if the SRPMs aren't yet on
ftp.redhat.com. Could somebody please look for them?

https://rhn.redhat.com/errata/RHSA-2007-0936.html
https://rhn.redhat.com/errata/RHSA-2007-0937.html
https://rhn.redhat.com/errata/RHSA-2007-0938.html

vs

ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/
etc.
Comment 30 Mark J. Cox (Product Security) 2007-10-01 02:14:51 EDT
Jan, we had a short outage on our main ftp server on Friday during which time
the SRPMS we pushed on Thursday were missing from the ftp site.  (They were at
all times available via Red Hat Network).  

I checked this yesterday and the RHEL3 and RHEL4 srpms were present, but the
RHEL5 ones were missing.  This was escalated to our production engineering team
who resolved it.

I've checked again today and the kernel SRPMS for RHEL3, RHEL4, RHEL5 are all
there now (note RHEL5 updates are always in a different place at
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS )

Note You need to log in before you can comment on or make changes to this bug.