retire old SG_IO issue

move two conceptual disk-encryption issues to ignored


git-svn-id: svn+ssh://svn.debian.org/svn/kernel-sec@792 e094ebfe-e918-0410-adfb-c712417f3574

1 files changed, 30 insertions, 0 deletions

diff --git a/retired/CVE-2004-0813 b/retired/CVE-2004-0813
new file mode 100644
index 00000000..525f8717
--- /dev/null
+++ b/retired/CVE-2004-0813
@@ -0,0 +1,30 @@
+Candidate: CVE-2004-0813
+References: 
+ MISC:http://lkml.org/lkml/2004/7/30/147
+ XF:linux-sgio-gain-privileges(17505)
+ URL:http://xforce.iss.net/xforce/xfdb/17505
+Description: 
+ Unknown vulnerability in the SG_IO functionality in ide-cd allows local users
+ to bypass read-only access and perform unauthorized write and erase
+ operations.
+Notes: 
+ dannf> RedHat is still vulnerable, but there has been recent activity:
+  https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=133098
+ dannf> I wonder if one of the patches listed for CVE-2004-1190 fixes this?
+ horms> I'm pretty sure this is fixed by the series of patches for SG_IO
+        added upstream in 2.6.8 and the immediately following period.
+	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=300162
+	That should clean things up for 2.6. 
+	2.4 doesn't suffer this problem exactly, unless
+	the permisions of /dev/sg* are botched.
+	Alan Cox seems to think that is bad, but I'm not so sure.
+	https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=133098
+ jmm> Marking 2.4 as N/A, as only local config mistakes would make that
+ jmm> a problem
+Bugs: 
+upstream: fixed (2.6.10)
+linux-2.6: N/A
+2.6.8-sarge-security: released (2.6.8-14)
+2.4.27-sarge-security: N/A
+2.6.18-etch-security: N/A
+