Bug 460401 (CVE-2008-3525) - CVE-2008-3525 kernel: missing capability checks in sbni_ioctl()
Summary: CVE-2008-3525 kernel: missing capability checks in sbni_ioctl()
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2008-3525
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 460402 460403 460404
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-08-28 03:38 UTC by Eugene Teo (Security Response)
Modified: 2019-09-29 12:26 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-12-21 17:25:30 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2008:0787 0 normal SHIPPED_LIVE Important: kernel security update 2009-01-05 07:08:54 UTC
Red Hat Product Errata RHSA-2008:0973 0 normal SHIPPED_LIVE Important: kernel security and bug fix update 2008-12-17 03:18:50 UTC
Red Hat Product Errata RHSA-2009:0001 0 normal SHIPPED_LIVE Important: kernel security update 2009-01-08 15:47:52 UTC

Description Eugene Teo (Security Response) 2008-08-28 03:38:28 UTC 
Description of problem:
Eugene Teo reported some bogus capability checks in SBNI WAN driver. Proper capability checks are required for the privileged operations.

Reference:
http://marc.info/?l=linux-netdev&m=121980722629750&w=2
Comment 1 Eugene Teo (Security Response) 2008-08-28 03:42:46 UTC 
Proposed upstream patch:
http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git;a=commitdiff;h=f2455eb176ac87081bbfc9a44b21c7cd2bc1967e

Not in linux-2.6 yet.
Comment 4 Eugene Teo (Security Response) 2008-08-29 01:37:39 UTC 
(In reply to comment #1)
> Proposed upstream patch:
> http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git;a=commitdiff;h=f2455eb176ac87081bbfc9a44b21c7cd2bc1967e

In linux-2.6 now.

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=f2455eb176ac87081bbfc9a44b21c7cd2bc1967e
Comment 5 Fedora Update System 2008-10-23 16:37:56 UTC 
kernel-2.6.26.6-49.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Vincent Danen 2010-12-21 17:25:30 UTC 
This was addressed via:

Red Hat Linux Advanced Workstation 2.1 (RHSA-2008:0787)
Red Hat Enterprise Linux version 3 (RHSA-2008:0973)
Red Hat Enterprise Linux version 2.1 (RHSA-2009:0001)
Note You need to log in before you can comment on or make changes to this bug.