Bug 647416 (CVE-2010-3865) - CVE-2010-3865 kernel: iovec integer overflow in net/rds/rdma.c
Summary: CVE-2010-3865 kernel: iovec integer overflow in net/rds/rdma.c
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2010-3865
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 647421 647422 647423 647424
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-10-28 09:50 UTC by Eugene Teo (Security Response)
Modified: 2023-05-12 11:52 UTC (History)
14 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-03-28 08:44:42 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:0004 0 normal SHIPPED_LIVE Important: kernel security, bug fix, and enhancement update 2011-01-04 16:52:05 UTC
Red Hat Product Errata RHSA-2011:0007 0 normal SHIPPED_LIVE Important: kernel security and bug fix update 2011-01-11 19:44:55 UTC

Comment 1 Eugene Teo (Security Response) 2010-10-28 09:53:50 UTC
As reported by Thomas Pollet, the rdma page counting can overflow.  We get the rdma sizes in 64-bit unsigned entities, but then limit it to UINT_MAX bytes and shift them down to pages (so with a possible "+1" for an unaligned address). 

So each individual page count fits comfortably in an 'unsigned int' (not even close to overflowing into signed), but as they are added up, they might end up resulting in a signed return value. Which would be wrong.

Catch the case of tot_pages turning negative, and return the appropriate error code.

http://www.spinics.net/lists/netdev/msg145359.html
http://www.spinics.net/lists/netdev/msg145397.html

Introduced in commit eff5f53bef75c0864a5da06bb688939092b848dc (v2.6.30-rc1)

Acknowledgements:

Red Hat would like to thank Thomas Pollet for reporting this issue.

Comment 3 Eugene Teo (Security Response) 2010-10-28 09:57:41 UTC
Statement:

The Linux kernel as shipped with Red Hat Enterprise Linux 3, 4 and Red Hat
Enterprise MRG did not include support for the RDS Protocol, and therefore are
not affected by this issue. Future kernel updates in Red Hat Enterprise Linux 5
may address this flaw.

Mitigation:

For users that do not run applications that use RDS, you can prevent the rds
module from being loaded by adding the following entry to the end of the
/etc/modprobe.d/blacklist file:

blacklist rds

This way, the rds module cannot be loaded accidentally, which may occur if an
application that requires RDS is started. A reboot is not necessary for this
change to take effect but do make sure the module is not loaded in the first
place. You can verify that by running:

lsmod | grep rds

You may also consider removing the CAP_SYS_MODULE capability from the current
global capability set to prevent kernel modules from being loaded or unloaded.
The CAP_SYS_MODULE has a capability number of 16 (see linux/capability.h). The
default value has all the bits set. To remove this capability, you have to
clear the 16th bit of the default 32-bit value, e.g. 0xffffff ^ (1 << 16):

echo 0xFFFEFFFF > /proc/sys/kernel/cap-bound

Comment 6 Eugene Teo (Security Response) 2010-11-10 11:00:44 UTC
Upstream commit:
http://git.kernel.org/linus/1b1f693d7ad6d193862dcb1118540a030c5e761f

Comment 12 errata-xmlrpc 2011-01-04 16:52:49 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2011:0004 https://rhn.redhat.com/errata/RHSA-2011-0004.html

Comment 13 errata-xmlrpc 2011-01-11 19:45:10 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:0007 https://rhn.redhat.com/errata/RHSA-2011-0007.html


Note You need to log in before you can comment on or make changes to this bug.