Description of problem: Olaf Kirch noticed that the i915_set_status_page() function of the i915 kernel driver calls ioremap with an address offset that is supplied by userspace via ioctl. The function zeroes the mapped memory via memset and tells the hardware about the address. Turns out that access to that ioctl is not restricted to root so users could probably exploit that to do nasty things. We haven't tried to write actual exploit code though.
Created attachment 317979 [details] Proposed patch commit 6dbfadaae00a1238c01a6a04b02cb484cd9072e7 Author: Matthias Hopf <mhopf> Date: Fri Sep 26 16:47:03 2008 +0200 Only allow access to DRM_I915_HWS_ADDR ioctl() for Xserver.
Created attachment 319200 [details] Proposed backport patch for realtime kernel
The patch has been added to MRG's -83 kernel.
Public now via: http://lkml.org/lkml/2008/10/17/449 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4b40893918203ee1a1f6a114316c2a19c072e9bd
(In reply to comment #9) > Public now via: > > http://lkml.org/lkml/2008/10/17/449 > http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4b40893918203ee1a1f6a114316c2a19c072e9bd And this http://www.debian.org/security/2008/dsa-1655 Thanks Tomas. Eugene
kernel-2.6.26.6-49.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.
This was addressed via: Red Hat Enterprise Linux version 5 (RHSA-2008:1017) MRG Realtime for RHEL 5 Server (RHSA-2009:0009)