From 34931cb0d3850a032ae3d5930dbf0885fabc808f Mon Sep 17 00:00:00 2001
From: Salvatore Bonaccorso <carnil@debian.org>
Date: Tue, 2 Jan 2018 11:39:07 +0100
Subject: Retire CVE-2017-1000405

---
 retired/CVE-2017-1000405 | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 retired/CVE-2017-1000405

(limited to 'retired/CVE-2017-1000405')

diff --git a/retired/CVE-2017-1000405 b/retired/CVE-2017-1000405
new file mode 100644
index 00000000..6d781181
--- /dev/null
+++ b/retired/CVE-2017-1000405
@@ -0,0 +1,19 @@
+Description: "Dirty COW" variant on transparent huge pages
+References:
+ http://www.openwall.com/lists/oss-security/2017/11/30/1
+ https://github.com/bindecy/HugeDirtyCowPOC
+Notes:
+ carnil> The upstream commit 8310d48b125d19fcd9521d83b8293e63eb1646aa
+ carnil> allows the race condition, and was backported to 3.2.87,
+ carnil> 3.16.42 and 4.9.7.
+ bwh> But in 3.2 dirty bits didn't work on s390, so the backported version of
+ bwh> can_follow_write_pmd() doesn't use them.
+Bugs:
+upstream: released (4.15-rc2) [a8f97366452ed491d13cf1e44241bc0b5740b1f0]
+4.9-upstream-stable: released (4.9.67) [7031ae2ab37d3df53c4a4e9903329a5d38c745ec]
+3.16-upstream-stable: released (3.16.52) [ec041ea68228f2d025e2fa1b5c90a801605d063b]
+3.2-upstream-stable: N/A "Vulnerable code not present"
+sid: released (4.14.2-1) [bugfix/all/mm-thp-Do-not-make-page-table-dirty-unconditionally-.patch]
+4.9-stretch-security: released (4.9.65-1)
+3.16-jessie-security: released (3.16.51-1)
+3.2-wheezy-security: N/A "Vulnerable code not present"
-- 
cgit v1.2.3