Red Hat Bugzilla – Bug 631716
CVE-2010-3066 kernel: io_submit_one() NULL ptr deref
Last modified: 2015-05-04 21:26:55 EDT
Description of problem:
Missing backport patch:
Author: Yan Zheng <email@example.com>
Date: Mon Oct 8 12:16:20 2007 -0700
AIO: fix cleanup in io_submit_one(...)
When IOCB_FLAG_RESFD flag is set and iocb->aio_resfd is incorrect,
statement 'goto out_put_req' is executed. At label 'out_put_req',
aio_put_req(..) is called, which requires 'req->ki_filp' set.
Red Hat would like to thank Tavis Ormandy for reporting this issue.
The aio eventfd patches weren't backported to RHEL 4, so this bug doesn't exist on RHEL 4 at all.
(In reply to comment #4)
> The aio eventfd patches weren't backported to RHEL 4, so this bug doesn't exist
> on RHEL 4 at all.
That's certainly nice, but still this bug exists for rhel5 and as this bz is the root bug, closing it with NOTABUG is just bogus -> Setting state to ASSIGNED.
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Via RHSA-2010:0839 https://rhn.redhat.com/errata/RHSA-2010-0839.html
This issue did not affect the version of Linux kernel as shipped with Red Hat
Enterprise Linux 3 and 4 as they did not include support for eventfd in the
Async I/O (AIO) implementation. It did not affect the version of Linux kernel
as shipped with Red Hat Enterprise MRG as it has already had the fix to this
issue. This issue was addressed in Red Hat Enterprise Linux 5 via https://rhn.redhat.com/errata/RHSA-2010-0839.html