Bug 656264 (CVE-2010-4248) - CVE-2010-4248 kernel: posix-cpu-timers: workaround to suppress the problems with mt exec
Summary: CVE-2010-4248 kernel: posix-cpu-timers: workaround to suppress the problems w...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2010-4248
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 656265 656266 656267 656268 656269
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-11-23 11:16 UTC by Eugene Teo (Security Response)
Modified: 2021-02-24 17:00 UTC (History)
15 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-07-29 13:24:36 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:0004 0 normal SHIPPED_LIVE Important: kernel security, bug fix, and enhancement update 2011-01-04 16:52:05 UTC
Red Hat Product Errata RHSA-2011:0007 0 normal SHIPPED_LIVE Important: kernel security and bug fix update 2011-01-11 19:44:55 UTC
Red Hat Product Errata RHSA-2011:0330 0 normal SHIPPED_LIVE Important: kernel-rt security and bug fix update 2011-03-10 20:04:13 UTC

Description Eugene Teo (Security Response) 2010-11-23 11:16:17 UTC
posix-cpu-timers: workaround to suppress the problems with mt exec
    
posix-cpu-timers.c correctly assumes that the dying process does
posix_cpu_timers_exit_group() and removes all !CPUCLOCK_PERTHREAD
timers from signal->cpu_timers list.
    
But, it also assumes that timer->it.cpu.task is always the group
leader, and thus the dead ->task means the dead thread group.
    
This is obviously not true after de_thread() changes the leader.
After that almost every posix_cpu_timer_ method has problems.
    
It is not simple to fix this bug correctly. First of all, I think
that timer->it.cpu should use struct pid instead of task_struct.
Also, the locking should be reworked completely. In particular,
tasklist_lock should not be used at all. This all needs a lot of
nontrivial and hard-to-test changes.
    
Change __exit_signal() to do posix_cpu_timers_exit_group() when
the old leader dies during exec. This is not the fix, just the
temporary hack to hide the problem for 2.6.37 and stable. IOW,
this is obviously wrong but this is what we currently have anyway:
cpu timers do not work after mt exec.
    
In theory this change adds another race. The exiting leader can
detach the timers which were attached to the new leader. However,
the window between de_thread() and release_task() is small, we
can pretend that sys_timer_create() was called before de_thread().

Upstream commit:
http://git.kernel.org/linus/e0a70217107e6f9844628120412cb27bb4cea194

Comment 3 Kyle McMartin 2010-11-23 16:44:58 UTC
Thanks Eugene, committed for Fedora.

Comment 4 Eugene Teo (Security Response) 2010-11-25 07:16:03 UTC
Statement:

This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 4 as it did not have support for CPU time clocks for the POSIX clock interface. This has been addressed in Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0004.html, https://rhn.redhat.com/errata/RHSA-2011-0007.html and https://rhn.redhat.com/errata/RHSA-2011-0330.html.

Comment 5 errata-xmlrpc 2011-01-04 16:53:19 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2011:0004 https://rhn.redhat.com/errata/RHSA-2011-0004.html

Comment 6 errata-xmlrpc 2011-01-11 19:45:50 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:0007 https://rhn.redhat.com/errata/RHSA-2011-0007.html

Comment 7 errata-xmlrpc 2011-03-10 20:04:40 UTC
This issue has been addressed in following products:

  MRG for RHEL-5

Via RHSA-2011:0330 https://rhn.redhat.com/errata/RHSA-2011-0330.html


Note You need to log in before you can comment on or make changes to this bug.