Bug 800813 (CVE-2012-1146) - CVE-2012-1146 kernel: mm: memcg: unregistring of events attached to the same eventfd can lead to oops
Summary: CVE-2012-1146 kernel: mm: memcg: unregistring of events attached to the same ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2012-1146
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20120224,repor...
Depends On: 800817
Blocks: 800815
TreeView+ depends on / blocked
 
Reported: 2012-03-07 10:33 UTC by Petr Matousek
Modified: 2019-06-08 19:04 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-05-10 15:43:41 UTC


Attachments (Terms of Use)

Description Petr Matousek 2012-03-07 10:33:34 UTC
There is an issue when memcg unregisters events that were attached to
the same eventfd:

- On the first call mem_cgroup_usage_unregister_event() removes all
  events attached to a given eventfd, and if there were no events left,
  thresholds->primary would become NULL;

- Since there were several events registered, cgroups core will call
  mem_cgroup_usage_unregister_event() again, but now kernel will oops,
  as the function doesn't expect that threshold->primary may be NULL.

FWIW, w/o the patch the following oops may be observed:

 BUG: unable to handle kernel NULL pointer dereference at 0000000000000004
 IP: [<ffffffff810be32c>] mem_cgroup_usage_unregister_event+0x9c/0x1f0
 Pid: 574, comm: kworker/0:2 Not tainted 3.3.0-rc4+ #9 Bochs Bochs
 RIP: 0010:[<ffffffff810be32c>]  [<ffffffff810be32c>] mem_cgroup_usage_unregister_event+0x9c/0x1f0
 RSP: 0018:ffff88001d0b9d60  EFLAGS: 00010246
 Process kworker/0:2 (pid: 574, threadinfo ffff88001d0b8000, task ffff88001de91cc0)
 Call Trace:
  [<ffffffff8107092b>] cgroup_event_remove+0x2b/0x60
  [<ffffffff8103db94>] process_one_work+0x174/0x450
  [<ffffffff8103e413>] worker_thread+0x123/0x2d0

A local attacker able to register threshold events could use this flaw
to crash the system.

Upstream commit:
http://git.kernel.org/linus/371528c

Comment 2 Petr Matousek 2012-03-07 10:43:41 UTC
Created kernel tracking bugs for this issue

Affects: fedora-all [bug 800817]

Comment 3 Petr Matousek 2012-03-07 11:09:42 UTC
Statement:

This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5 as they did not include support for control groups. This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6 as they did not include support for memory control groups threshold notifications. This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise MRG as they did not include support for memory control groups.

Comment 4 Kurt Seifried 2012-03-07 16:35:21 UTC
Added CVE as per http://www.openwall.com/lists/oss-security/2012/03/07/3

Comment 5 Fedora Update System 2012-03-17 23:58:26 UTC
kernel-3.2.10-3.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2012-03-26 18:01:38 UTC
kernel-2.6.42.12-1.fc15 has been pushed to the Fedora 15 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.