blob: 3b95e936bb5e828dd19aba03c2240f0662eb007a (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
|
Candidate: CVE-2007-3731
References:
MISC:http://bugzilla.kernel.org/show_bug.cgi?id=8765
CONFIRM:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=29eb51101c02df517ca64ec472d7501127ad1da8
CONFIRM:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=a10d9a71bafd3a283da240d2868e71346d2aef6f
CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=248324
Description:
The Linux kernel 2.6.20 and 2.6.21 does not properly handle an invalid LDT
segment selector in %cs (the xcs field) during ptrace single-step operations,
which allows local users to cause a denial of service (NULL dereference and
OOPS) via certain code that makes ptrace PTRACE_SETREGS and PTRACE_SINGLESTEP
requests, related to the TRACE_IRQS_ON function, and possibly related to the
arch_ptrace function.
Ubuntu-Description:
Evan Teran discovered that the Linux kernel ptrace routines did not
correctly handle certain requests robustly. Local attackers could
exploit this to crash the system, causing a denial of service.
Notes:
dannf> Note that the description is somewhat misleading - I can reproduce
on 2.6.18, so its not limited to 2.6.20 and 2.6.21
jmm> a10d9a71bafd3a283da240d2868e71346d2aef6f
dannf> reproducer in http://bugzilla.kernel.org/show_bug.cgi?id=8765
Bugs:
upstream: released (2.6.23-rc1)
linux-2.6: released (2.6.23-1)
2.6.18-etch-security: released (2.6.18.dfsg.1-13etch3) [bugfix/ptrace-handle-bogus-selector.patch, bugfix/fixup-trace_irq-breakage.patch]
2.6.8-sarge-security: N/A "cannot reproduce in 2.6.8, code is very different"
2.4.27-sarge-security: N/A "cannot reproduce in 2.4"
2.6.15-dapper-security: released (2.6.15-29.59)
2.6.17-edgy-security: released (2.6.17.1-12.41 17fc2937158a31e501e7e0aae9e3951b9ca49a0a, cd01b60fda15bb9d76eecf9420c989c3248881f6)
2.6.20-feisty-security: released (2.6.20-16.32 6227bc5e0cc5f5993c51f05f77d4602d5602b888, 2d7bfc148eece4514edf175b7e75d7fa48555fa2)
|
