Bug 582076 (CVE-2010-1162) - CVE-2010-1162 kernel: tty: release_one_tty() forgets to put pids
Summary: CVE-2010-1162 kernel: tty: release_one_tty() forgets to put pids
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2010-1162
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 579408 582077 582444
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-04-14 02:55 UTC by Eugene Teo (Security Response)
Modified: 2021-02-24 23:17 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-03-29 10:15:20 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2010:0631 0 normal SHIPPED_LIVE Important: kernel-rt security and bug fix update 2010-08-18 07:58:39 UTC

Description Eugene Teo (Security Response) 2010-04-14 02:55:34 UTC 
Description of problem:
release_one_tty(tty) can be called when tty still has a reference to pgrp/session. In this case we leak the pid.

Upstream commit:
http://git.kernel.org/linus/6da8d866d0d39e9509ff826660f6a86a6757c966
Comment 6 Eugene Teo (Security Response) 2010-04-15 00:41:20 UTC 
pgrp member in struct tty_struct was converted to struct pid in commit ab521dc0, so kernels of version v2.6.21-rc1 and above are affected by this. mrg-1 backported this patch.

Statement:

This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 3, 4 and 5 as they did not include upstream commit ab521dc0 that introduced the problem. This issue was addressed in Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2010-0631.html.
Comment 8 errata-xmlrpc 2010-08-17 15:54:25 UTC 
This issue has been addressed in following products:

  MRG for RHEL-5

Via RHSA-2010:0631 https://rhn.redhat.com/errata/RHSA-2010-0631.html
Comment 9 Mike McCune 2016-03-28 23:33:48 UTC 
This bug was accidentally moved from POST to MODIFIED via an error in automation, please see mmccune with any questions
Note You need to log in before you can comment on or make changes to this bug.