[kernel-sec-discuss] r1137 - active retired
jmm at alioth.debian.org
jmm at alioth.debian.org
Tue Feb 19 18:15:49 UTC 2008
Author: jmm
Date: 2008-02-19 18:15:48 +0000 (Tue, 19 Feb 2008)
New Revision: 1137
Added:
retired/CVE-2007-0997
retired/CVE-2007-3731
Removed:
active/CVE-2007-0997
active/CVE-2007-3731
Log:
retire two issues
Deleted: active/CVE-2007-0997
===================================================================
--- active/CVE-2007-0997 2008-02-19 07:08:36 UTC (rev 1136)
+++ active/CVE-2007-0997 2008-02-19 18:15:48 UTC (rev 1137)
@@ -1,23 +0,0 @@
-Candidate: CVE-2007-0997
-References:
- http://lkml.org/lkml/2006/7/17/140
- http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.18
-Description:
- Race condition in the tee (sys_tee) system call in the Linux kernel 2.6.17 through
- 2.6.17.6 might allow local users to cause a denial of service (system crash), obtain
- sensitive information (kernel memory contents), or gain privileges via unspecified
- vectors related to a potentially dropped ipipe lock during a race between two pipe
- readers.
-Ubuntu-Description:
-Notes:
- jmm> commit aadd06e5c56b9ff5117ec77e59eada43dc46e2fc
-Bugs:
-upstream: released (2.6.18), release (2.6.17.7)
-linux-2.6: released (2.6.18-1)
-2.6.18-etch-security: N/A
-2.6.8-sarge-security: N/A
-2.4.27-sarge-security: N/A "no sys_tee in 2.4"
-2.6.15-dapper-security: N/A
-2.6.17-edgy-security: N/A
-2.6.20-feisty-security: N/A
-2.6.22-gutsy-security: N/A
Deleted: active/CVE-2007-3731
===================================================================
--- active/CVE-2007-3731 2008-02-19 07:08:36 UTC (rev 1136)
+++ active/CVE-2007-3731 2008-02-19 18:15:48 UTC (rev 1137)
@@ -1,31 +0,0 @@
-Candidate: CVE-2007-3731
-References:
- MISC:http://bugzilla.kernel.org/show_bug.cgi?id=8765
- CONFIRM:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=29eb51101c02df517ca64ec472d7501127ad1da8
- CONFIRM:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=a10d9a71bafd3a283da240d2868e71346d2aef6f
- CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=248324
-Description:
- The Linux kernel 2.6.20 and 2.6.21 does not properly handle an invalid LDT
- segment selector in %cs (the xcs field) during ptrace single-step operations,
- which allows local users to cause a denial of service (NULL dereference and
- OOPS) via certain code that makes ptrace PTRACE_SETREGS and PTRACE_SINGLESTEP
- requests, related to the TRACE_IRQS_ON function, and possibly related to the
- arch_ptrace function.
-Ubuntu-Description:
- Evan Teran discovered that the Linux kernel ptrace routines did not
- correctly handle certain requests robustly. Local attackers could
- exploit this to crash the system, causing a denial of service.
-Notes:
- dannf> Note that the description is somewhat misleading - I can reproduce
- on 2.6.18, so its not limited to 2.6.20 and 2.6.21
- jmm> a10d9a71bafd3a283da240d2868e71346d2aef6f
- dannf> reproducer in http://bugzilla.kernel.org/show_bug.cgi?id=8765
-Bugs:
-upstream: released (2.6.23-rc1)
-linux-2.6: released (2.6.23-1)
-2.6.18-etch-security: released (2.6.18.dfsg.1-13etch3) [bugfix/ptrace-handle-bogus-selector.patch, bugfix/fixup-trace_irq-breakage.patch]
-2.6.8-sarge-security: N/A "cannot reproduce in 2.6.8, code is very different"
-2.4.27-sarge-security: N/A "cannot reproduce in 2.4"
-2.6.15-dapper-security: released (2.6.15-29.59)
-2.6.17-edgy-security: released (2.6.17.1-12.41 17fc2937158a31e501e7e0aae9e3951b9ca49a0a, cd01b60fda15bb9d76eecf9420c989c3248881f6)
-2.6.20-feisty-security: released (2.6.20-16.32 6227bc5e0cc5f5993c51f05f77d4602d5602b888, 2d7bfc148eece4514edf175b7e75d7fa48555fa2)
Copied: retired/CVE-2007-0997 (from rev 1129, active/CVE-2007-0997)
===================================================================
--- retired/CVE-2007-0997 (rev 0)
+++ retired/CVE-2007-0997 2008-02-19 18:15:48 UTC (rev 1137)
@@ -0,0 +1,23 @@
+Candidate: CVE-2007-0997
+References:
+ http://lkml.org/lkml/2006/7/17/140
+ http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.18
+Description:
+ Race condition in the tee (sys_tee) system call in the Linux kernel 2.6.17 through
+ 2.6.17.6 might allow local users to cause a denial of service (system crash), obtain
+ sensitive information (kernel memory contents), or gain privileges via unspecified
+ vectors related to a potentially dropped ipipe lock during a race between two pipe
+ readers.
+Ubuntu-Description:
+Notes:
+ jmm> commit aadd06e5c56b9ff5117ec77e59eada43dc46e2fc
+Bugs:
+upstream: released (2.6.18), release (2.6.17.7)
+linux-2.6: released (2.6.18-1)
+2.6.18-etch-security: N/A
+2.6.8-sarge-security: N/A
+2.4.27-sarge-security: N/A "no sys_tee in 2.4"
+2.6.15-dapper-security: N/A
+2.6.17-edgy-security: N/A
+2.6.20-feisty-security: N/A
+2.6.22-gutsy-security: N/A
Copied: retired/CVE-2007-3731 (from rev 1136, active/CVE-2007-3731)
===================================================================
--- retired/CVE-2007-3731 (rev 0)
+++ retired/CVE-2007-3731 2008-02-19 18:15:48 UTC (rev 1137)
@@ -0,0 +1,31 @@
+Candidate: CVE-2007-3731
+References:
+ MISC:http://bugzilla.kernel.org/show_bug.cgi?id=8765
+ CONFIRM:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=29eb51101c02df517ca64ec472d7501127ad1da8
+ CONFIRM:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=a10d9a71bafd3a283da240d2868e71346d2aef6f
+ CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=248324
+Description:
+ The Linux kernel 2.6.20 and 2.6.21 does not properly handle an invalid LDT
+ segment selector in %cs (the xcs field) during ptrace single-step operations,
+ which allows local users to cause a denial of service (NULL dereference and
+ OOPS) via certain code that makes ptrace PTRACE_SETREGS and PTRACE_SINGLESTEP
+ requests, related to the TRACE_IRQS_ON function, and possibly related to the
+ arch_ptrace function.
+Ubuntu-Description:
+ Evan Teran discovered that the Linux kernel ptrace routines did not
+ correctly handle certain requests robustly. Local attackers could
+ exploit this to crash the system, causing a denial of service.
+Notes:
+ dannf> Note that the description is somewhat misleading - I can reproduce
+ on 2.6.18, so its not limited to 2.6.20 and 2.6.21
+ jmm> a10d9a71bafd3a283da240d2868e71346d2aef6f
+ dannf> reproducer in http://bugzilla.kernel.org/show_bug.cgi?id=8765
+Bugs:
+upstream: released (2.6.23-rc1)
+linux-2.6: released (2.6.23-1)
+2.6.18-etch-security: released (2.6.18.dfsg.1-13etch3) [bugfix/ptrace-handle-bogus-selector.patch, bugfix/fixup-trace_irq-breakage.patch]
+2.6.8-sarge-security: N/A "cannot reproduce in 2.6.8, code is very different"
+2.4.27-sarge-security: N/A "cannot reproduce in 2.4"
+2.6.15-dapper-security: released (2.6.15-29.59)
+2.6.17-edgy-security: released (2.6.17.1-12.41 17fc2937158a31e501e7e0aae9e3951b9ca49a0a, cd01b60fda15bb9d76eecf9420c989c3248881f6)
+2.6.20-feisty-security: released (2.6.20-16.32 6227bc5e0cc5f5993c51f05f77d4602d5602b888, 2d7bfc148eece4514edf175b7e75d7fa48555fa2)
More information about the kernel-sec-discuss
mailing list