This service will be undergoing maintenance at 00:00 UTC, 2016-08-01. It is expected to last about 1 hours
Bug 628770 - (CVE-2010-2954) CVE-2010-2954 kernel: NULL deref and panic in irda
CVE-2010-2954 kernel: NULL deref and panic in irda
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
reported=20100831,public=20100831,sou...
: Security
Depends On: 628771
Blocks:
  Show dependency treegraph
 
Reported: 2010-08-30 22:02 EDT by Eugene Teo (Security Response)
Modified: 2016-03-04 07:08 EST (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-12-21 12:08:34 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Eugene Teo (Security Response) 2010-08-30 22:02:34 EDT
Description of problem:
BUG: unable to handle kernel NULL pointer dereference at 00000004
IP: [<f7f06dca>] hashbin_delete+0x14/0xad [irda]
*pdpt = 0000000000a57001 *pde = 0000000000000000
Oops: 0000 [#1] SMP
last sysfs file: /sys/devices/virtual/dmi/id/sys_vendor
Modules linked in: irda crc_ccitt fuse ip6t_REJECT nf_conntrack_ipv6 ip6table_filter ip6_tables ipv6 vmblock vsock vmmemctl vmhgfs uinput pcnet32 ppdev vmxnet microcode parport_pc parport mii vmci i2c_piix4 i2c_core mptspi mptscsih mptbase scsi_transport_spi [last unloaded: scsi_wait_scan]

Pid: 2403, comm: a.out Not tainted 2.6.33.6-147.2.4.fc13.i686.PAE #1 440BX Desktop Reference Platform/VMware Virtual Platform
EIP: 0060:[<f7f06dca>] EFLAGS: 00010282 CPU: 0
EIP is at hashbin_delete+0x14/0xad [irda]
EAX: 00000000 EBX: 00000000 ECX: f2f97f4c EDX: f7f084aa
ESI: df1b8800 EDI: f7f084aa EBP: eb19bd78 ESP: eb19bd64
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process a.out (pid: 2403, ti=eb19a000 task=f2ed9980 task.ti=eb19a000)
Stack:
 00000000 00000202 eb0df2c0 df1b8800 df1a6770 eb19bd84 f7f085f5 eb0df2c0
<0> eb19bd90 f7f0861f eb20c400 eb19bda4 f7f0a958 df1b8800 f7f0ebe4 df1a6770
<0> eb19bdb4 c06ef16e f2e21100 00000008 eb19bdbc c06ef1cf eb19bde0 c04d183a
Call Trace:
 [<f7f085f5>] ? __irias_delete_object+0x1b/0x2c [irda]
 [<f7f0861f>] ? irias_delete_object+0x19/0x1e [irda]
 [<f7f0a958>] ? irda_release+0x65/0x127 [irda]
 [<c06ef16e>] ? sock_release+0x14/0x59
 [<c06ef1cf>] ? sock_close+0x1c/0x20
 [<c04d183a>] ? __fput+0xea/0x181
 [<c04d18e4>] ? fput+0x13/0x15
 [<c04cef5f>] ? filp_close+0x51/0x5b
 [<c043f260>] ? put_files_struct+0x5f/0xb3
 [<c043f2e8>] ? exit_files+0x34/0x38
 [<c0440a1b>] ? do_exit+0x200/0x615
 [<c044c4c0>] ? dequeue_signal+0xb1/0x120
 [<c0440e9b>] ? do_group_exit+0x6b/0x94
 [<c044c89d>] ? get_signal_to_deliver+0x36e/0x389
 [<c0407cd4>] ? do_signal+0x5a/0x6f4
 [<c078359d>] ? apic_timer_interrupt+0x31/0x38
 [<c0455f57>] ? hrtimer_nanosleep+0x94/0xdc
 [<c04d7376>] ? path_put+0x15/0x18
 [<c047c6a6>] ? audit_syscall_exit+0xfa/0x10f
 [<c040838d>] ? do_notify_resume+0x1f/0x79
 [<c07831e4>] ? work_notifysig+0x13/0x1b
Code: 04 01 74 0b 8b 55 f0 8d 43 0c e8 b8 bf 87 c8 83 c4 0c 5b 5e 5f 5d c3 55 89 e5 57 89 d7 56 53 89 c3 83 ec 08 c7 45 ec 00 00 00 00 <f6> 40 04 01 74 0b 8d 40 0c e8 40 bf 87 c8 89 45 ec 89 de c7 45
EIP: [<f7f06dca>] hashbin_delete+0x14/0xad [irda] SS:ESP 0068:eb19bd64
CR2: 0000000000000004
---[ end trace 8c5fb89ec896b3a8 ]---
Fixing recursive fault but reboot is needed!

Acknowledgements:

Red Hat would like to thank Tavis Ormandy for reporting this issue.
Comment 2 Eugene Teo (Security Response) 2010-08-30 22:18:02 EDT
Statement:

This issue did not affect the version of Linux kernel as shipped with Red Hat
Enterprise Linux 3, 4, 5, and Red Hat Enterprise MRG as it did not include
support for the IrDA protocol.
Comment 3 Eugene Teo (Security Response) 2010-08-31 04:20:08 EDT
fix:
[PATCH] irda: Correctly clean up self->ias_obj on irda_bind() failure.
http://www.spinics.net/lists/netdev/msg139404.html
Comment 6 Eugene Teo (Security Response) 2010-09-08 01:57:00 EDT
Upstream commit:
http://git.kernel.org/linus/628e300cccaa628d8fb92aa28cb7530a3d5f2257
Comment 7 Vincent Danen 2010-12-21 12:08:34 EST
This was corrected in Fedora via:

kernel-2.6.34.7-56.fc13
kernel-2.6.35.4-28.fc14

Note You need to log in before you can comment on or make changes to this bug.