Bug 534019
| Summary: | kernel: sysctl: require CAP_SYS_RAWIO to set mmap_min_addr [mrg-1] | ||
|---|---|---|---|
| Product: | Red Hat Enterprise MRG | Reporter: | Eugene Teo (Security Response) <eteo> |
| Component: | realtime-kernel | Assignee: | Clark Williams <williams> |
| Status: | CLOSED ERRATA | QA Contact: | David Sommerseth <davids> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 1.2 | CC: | bhu, eteo, jkacur, lbrindle, lgoncalv, mmcallis, ovasik, williams |
| Target Milestone: | 1.2 | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: |
Not in relnote
RT Bug fix
The "/proc/sys/vm/mmap_min_addr" tunable helps prevent unprivileged
users from creating new memory mappings below the minimum address. The
sysctl value for mmap_min_addr could be changed by a process or user that
has an effective user ID (euid) of 0, even if the process or user does not
have the CAP_SYS_RAWIO capability. This update adds a capability check for
the CAP_SYS_RAWIO capability before allowing the mmap_min_addr value to be
changed.
|
Story Points: | --- |
| Clone Of: | 534018 | Environment: | |
| Last Closed: | 2009-12-03 11:28:06 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 534018 | ||
| Bug Blocks: | 527551 | ||
|
Description
Eugene Teo (Security Response)
2009-11-10 06:15:58 UTC
Verified by code review. Found upstream patch implemented in 2.6.24.7-139.el5rt. CVS: check-for-CAP_SYS_RAWIO-before-allowing-mmap_min_add.patch mrg-rt-v1.git: b68cc1dbbbedef3428d63871b16fa36e41fcd6f2 Will try to validate this one with a reproducer. Release note added. If any revisions are required, please set the "requires_release_notes" flag to "?" and edit the "Release Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: RT Bug fix (security) C: the "/proc/sys/vm/mmap_min_addr" tunable helps prevent unprivileged users from creating new memory mappings below the minimum address. The sysctl value for mmap_min_addr could be changed by a process or user who has an effective user ID (euid) of 0, even if they do not have the CAP_SYS_RAWIO capability. C: This is a breach of security F: a check for the CAP_SYS_RAWIO capability has been added. R: The mmap_min_addr value can only be changed if the capability check passes. The "/proc/sys/vm/mmap_min_addr" tunable helps prevent unprivileged users from creating new memory mappings below the minimum address. The sysctl value for mmap_min_addr could be changed by a process or user who has an effective user ID (euid) of 0, even if they do not have the CAP_SYS_RAWIO capability. This update adds a check for the CAP_SYS_RAWIO capability before allowing the mmap_min_addr value to be changed. Release note updated. If any revisions are required, please set the "requires_release_notes" flag to "?" and edit the "Release Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. Diffed Contents: @@ -1,4 +1,4 @@ -RT Bug fix (security) +RT Bug fix C: the "/proc/sys/vm/mmap_min_addr" tunable helps prevent unprivileged users from creating new memory mappings below the minimum address. The sysctl value for mmap_min_addr could be changed by a process or user who has an effective user ID (euid) of 0, even if they do not have the Release note updated. If any revisions are required, please set the "requires_release_notes" flag to "?" and edit the "Release Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. Diffed Contents: @@ -1,3 +1,5 @@ +Not in relnote + RT Bug fix C: the "/proc/sys/vm/mmap_min_addr" tunable helps prevent unprivileged users from creating new memory mappings below the minimum address. The An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2009-1635.html |