Bug 1170691 (CVE-2014-9090) - CVE-2014-9090 kernel: espfix64: local DoS via do_double_fault() due to improper handling of faults associated with SS segment register
Summary: CVE-2014-9090 kernel: espfix64: local DoS via do_double_fault() due to improp...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2014-9090
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1170693
TreeView+ depends on / blocked
 
Reported: 2014-12-04 15:46 UTC by Vincent Danen
Modified: 2021-02-17 05:55 UTC (History)
27 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2019-06-08 02:37:02 UTC
Embargoed:

Attachments (Terms of Use)

Description Vincent Danen 2014-12-04 15:46:12 UTC 
Common Vulnerabilities and Exposures assigned an identifier CVE-2014-9090 to
the following vulnerability:

Name: CVE-2014-9090
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9090
Assigned: 20141126
Reference: http://www.openwall.com/lists/oss-security/2014/11/26/5
Reference: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6f442be2fb22be02cafa606f1769fa1e6f894441
Reference: https://github.com/torvalds/linux/commit/6f442be2fb22be02cafa606f1769fa1e6f894441

The do_double_fault function in arch/x86/kernel/traps.c in the Linux
kernel through 3.17.4 does not properly handle faults associated with
the Stack Segment (SS) segment register when espfix64 is involved,
which allows local users to cause a denial of service (panic) via a
modify_ldt system call, as demonstrated by sigreturn_32 in the
linux-clock-tests test suite.
Comment 4 Petr Matousek 2014-12-10 15:43:56 UTC 
Statement:

Not vulnerable.

This issue did not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise Linux MRG 2 because they do not have support for the x86-64 version of ESPfix functionality.
Comment 5 Fedora Update System 2014-12-12 04:06:54 UTC 
kernel-3.17.4-302.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2014-12-13 09:52:44 UTC 
kernel-3.17.6-200.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 Fedora Update System 2015-01-05 07:34:51 UTC 
kernel-3.14.27-100.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.