Bug 800813 - (CVE-2012-1146) CVE-2012-1146 kernel: mm: memcg: unregistring of events attached to the same eventfd can lead to oops
CVE-2012-1146 kernel: mm: memcg: unregistring of events attached to the same ...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20120224,repor...
: Security
Depends On: 800817
Blocks: 800815
  Show dependency treegraph
 
Reported: 2012-03-07 05:33 EST by Petr Matousek
Modified: 2012-05-10 11:43 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-05-10 11:43:41 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Petr Matousek 2012-03-07 05:33:34 EST
There is an issue when memcg unregisters events that were attached to
the same eventfd:

- On the first call mem_cgroup_usage_unregister_event() removes all
  events attached to a given eventfd, and if there were no events left,
  thresholds->primary would become NULL;

- Since there were several events registered, cgroups core will call
  mem_cgroup_usage_unregister_event() again, but now kernel will oops,
  as the function doesn't expect that threshold->primary may be NULL.

FWIW, w/o the patch the following oops may be observed:

 BUG: unable to handle kernel NULL pointer dereference at 0000000000000004
 IP: [<ffffffff810be32c>] mem_cgroup_usage_unregister_event+0x9c/0x1f0
 Pid: 574, comm: kworker/0:2 Not tainted 3.3.0-rc4+ #9 Bochs Bochs
 RIP: 0010:[<ffffffff810be32c>]  [<ffffffff810be32c>] mem_cgroup_usage_unregister_event+0x9c/0x1f0
 RSP: 0018:ffff88001d0b9d60  EFLAGS: 00010246
 Process kworker/0:2 (pid: 574, threadinfo ffff88001d0b8000, task ffff88001de91cc0)
 Call Trace:
  [<ffffffff8107092b>] cgroup_event_remove+0x2b/0x60
  [<ffffffff8103db94>] process_one_work+0x174/0x450
  [<ffffffff8103e413>] worker_thread+0x123/0x2d0

A local attacker able to register threshold events could use this flaw
to crash the system.

Upstream commit:
http://git.kernel.org/linus/371528c
Comment 2 Petr Matousek 2012-03-07 05:43:41 EST
Created kernel tracking bugs for this issue

Affects: fedora-all [bug 800817]
Comment 3 Petr Matousek 2012-03-07 06:09:42 EST
Statement:

This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5 as they did not include support for control groups. This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6 as they did not include support for memory control groups threshold notifications. This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise MRG as they did not include support for memory control groups.
Comment 4 Kurt Seifried 2012-03-07 11:35:21 EST
Added CVE as per http://www.openwall.com/lists/oss-security/2012/03/07/3
Comment 5 Fedora Update System 2012-03-17 19:58:26 EDT
kernel-3.2.10-3.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2012-03-26 14:01:38 EDT
kernel-2.6.42.12-1.fc15 has been pushed to the Fedora 15 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.