Bug 457703 – CVE-2008-3535 kernel: fix off-by-one error in iov_iter_advance()

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 457703 - (CVE-2008-3535) CVE-2008-3535 kernel: fix off-by-one error in iov_iter_advance()

Summary:	CVE-2008-3535 kernel: fix off-by-one error in iov_iter_advance()

Status:	CLOSED ERRATA

Aliases:	CVE-2008-3535

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,source=lkml,reported=20080...
Keywords:	Security

Depends On:	457705
Blocks:
	Show dependency tree / graph

Reported:	2008-08-03 22:45 EDT by Eugene Teo (Security Response)
Modified:	2016-03-04 07:42 EST (History)
CC List:	3 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2010-12-23 17:30:09 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
LTP testsuite package 20080630 (6.85 MB, application/x-gzip) 2008-08-03 22:55 EDT, Eugene Teo (Security Response)	no flags	Details
Proposed backported patch for MRG kernel (1.44 KB, patch) 2008-08-03 23:29 EDT, Eugene Teo (Security Response)	no flags	Details \| Diff
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2008:0857	normal	SHIPPED_LIVE	Important: kernel security and bug fix update	2008-10-07 15:18:59 EDT

Groups: None (edit)

Description Eugene Teo (Security Response) 2008-08-03 22:45:06 EDT

Description of problem:
Alexey Dobriyan reported that it is possible to crash a machine by running ftest03 from the LTP test suite (20080630).

The iov_iter_advance() function would look at the iov->iov_len entry even though it might have iterated over the whole array, and iov was pointing past the end.  This would cause DEBUG_PAGEALLOC to trigger a kernel page fault if the allocation was at the end of a page, and the next page was unallocated.

http://lkml.org/lkml/2008/7/30/446

Comment 1 Eugene Teo (Security Response) 2008-08-03 22:46:53 EDT

Proposed upstream patch:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=94ad374a0751f40d25e22e036c37f7263569d24c

Comment 2 Eugene Teo (Security Response) 2008-08-03 22:55:33 EDT

Created attachment 313297 [details]
LTP testsuite package 20080630

Comment 5 Eugene Teo (Security Response) 2008-08-03 23:29:43 EDT

Created attachment 313298 [details]
Proposed backported patch for MRG kernel

Comment 7 Vincent Danen 2010-12-23 17:30:09 EST

This was addressed via:

MRG Realtime for RHEL 5 Server (RHSA-2008:0857)

Note You need to log in before you can comment on or make changes to this bug.