retire two issues

git-svn-id: svn+ssh://svn.debian.org/svn/kernel-sec@1137 e094ebfe-e918-0410-adfb-c712417f3574

1 files changed, 31 insertions, 0 deletions

diff --git a/retired/CVE-2007-3731 b/retired/CVE-2007-3731
new file mode 100644
index 00000000..3b95e936
--- /dev/null
+++ b/retired/CVE-2007-3731
@@ -0,0 +1,31 @@
+Candidate: CVE-2007-3731
+References: 
+ MISC:http://bugzilla.kernel.org/show_bug.cgi?id=8765
+ CONFIRM:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=29eb51101c02df517ca64ec472d7501127ad1da8
+ CONFIRM:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=a10d9a71bafd3a283da240d2868e71346d2aef6f
+ CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=248324
+Description: 
+ The Linux kernel 2.6.20 and 2.6.21 does not properly handle an invalid LDT
+ segment selector in %cs (the xcs field) during ptrace single-step operations,
+ which allows local users to cause a denial of service (NULL dereference and
+ OOPS) via certain code that makes ptrace PTRACE_SETREGS and PTRACE_SINGLESTEP
+ requests, related to the TRACE_IRQS_ON function, and possibly related to the
+ arch_ptrace function.
+Ubuntu-Description: 
+ Evan Teran discovered that the Linux kernel ptrace routines did not
+ correctly handle certain requests robustly.  Local attackers could
+ exploit this to crash the system, causing a denial of service.
+Notes: 
+ dannf> Note that the description is somewhat misleading - I can reproduce
+        on 2.6.18, so its not limited to 2.6.20 and 2.6.21
+ jmm> a10d9a71bafd3a283da240d2868e71346d2aef6f
+ dannf> reproducer in http://bugzilla.kernel.org/show_bug.cgi?id=8765
+Bugs: 
+upstream: released (2.6.23-rc1)
+linux-2.6: released (2.6.23-1)
+2.6.18-etch-security: released (2.6.18.dfsg.1-13etch3) [bugfix/ptrace-handle-bogus-selector.patch, bugfix/fixup-trace_irq-breakage.patch]
+2.6.8-sarge-security: N/A "cannot reproduce in 2.6.8, code is very different"
+2.4.27-sarge-security: N/A "cannot reproduce in 2.4"
+2.6.15-dapper-security: released (2.6.15-29.59)
+2.6.17-edgy-security: released (2.6.17.1-12.41 17fc2937158a31e501e7e0aae9e3951b9ca49a0a, cd01b60fda15bb9d76eecf9420c989c3248881f6)
+2.6.20-feisty-security: released (2.6.20-16.32 6227bc5e0cc5f5993c51f05f77d4602d5602b888, 2d7bfc148eece4514edf175b7e75d7fa48555fa2)