Bug 528868 (CVE-2009-3612) - CVE-2009-3612 kernel: tcf_fill_node() infoleak due to typo in 9ef1d4c7
Summary: CVE-2009-3612 kernel: tcf_fill_node() infoleak due to typo in 9ef1d4c7
Keywords:
Status: ASSIGNED
Alias: CVE-2009-3612
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 527906 528869 528870 528871 528872 531611 537298
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-10-14 06:37 UTC by Eugene Teo (Security Response)
Modified: 2023-07-07 08:29 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 531611 (view as bug list)
Environment:
Last Closed: 2009-10-20 12:54:38 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2009:1540 0 normal SHIPPED_LIVE Important: kernel-rt security, bug fix, and enhancement update 2009-11-03 18:21:07 UTC
Red Hat Product Errata RHSA-2009:1670 0 normal SHIPPED_LIVE Important: kernel security and bug fix update 2009-12-15 17:18:47 UTC

Description Eugene Teo (Security Response) 2009-10-14 06:37:41 UTC 
Quote from http://patchwork.ozlabs.org/patch/35412/:
Commit 9ef1d4c7c7aca1cd436612b6ca785b726ffb8ed8 introduced a typo in initialization.
Comment 2 Eugene Teo (Security Response) 2009-10-15 02:48:43 UTC 
Incomplete fix for CVE-2005-4881.
Comment 3 Chuck Ebbert 2009-10-16 10:42:33 UTC 
Official upstream patch, now in 2.6.32-rc5:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff_plain;h=ad61df918c44316940404891d5082c63e79c256a
Comment 4 Fedora Update System 2009-10-18 01:57:14 UTC 
kernel-2.6.30.9-90.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/kernel-2.6.30.9-90.fc11
Comment 5 Jan Lieskovsky 2009-10-20 08:49:03 UTC 
MITRE's CVE-2009-3612 record:
-----------------------------
The tcf_fill_node function in net/sched/cls_api.c in the netlink
subsystem in the Linux kernel 2.6.x before 2.6.32-rc5, and 2.4.37.6
and earlier, does not initialize a certain tcm__pad2 structure member,
which might allow local users to obtain sensitive information from
kernel memory via unspecified vectors. NOTE: this issue exists because
of an incomplete fix for CVE-2005-4881.

References:
-----------
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ad61df918c44316940404891d5082c63e79c256a
http://patchwork.ozlabs.org/patch/35412/
http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.32-rc5
Comment 6 Vitaly Mayatskikh 2009-10-20 12:54:38 UTC 
This was fixed in 89.0.15 as a typo fix for bz521602 (CVE-2005-4881). Changelog will be actualized in next 4.8.z build.
Comment 7 Vitaly Mayatskikh 2009-10-20 12:55:21 UTC 
Sorry, comment was intened for 4.8.z bz :(
Comment 8 Fedora Update System 2009-10-27 06:47:16 UTC 
kernel-2.6.30.9-90.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 errata-xmlrpc 2009-11-03 18:21:46 UTC 
This issue has been addressed in following products:

  MRG for RHEL-5

Via RHSA-2009:1540 https://rhn.redhat.com/errata/RHSA-2009-1540.html
Comment 10 Fedora Update System 2009-11-05 05:14:54 UTC 
kernel-2.6.27.38-170.2.113.fc10 has been submitted as an update for Fedora 10.
http://admin.fedoraproject.org/updates/kernel-2.6.27.38-170.2.113.fc10
Comment 11 Fedora Update System 2009-11-06 00:05:11 UTC 
kernel-2.6.27.38-170.2.113.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 13 errata-xmlrpc 2009-12-15 17:19:10 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:1670 https://rhn.redhat.com/errata/RHSA-2009-1670.html
Note You need to log in before you can comment on or make changes to this bug.