[kernel-sec-discuss] r1599 - active

[Dann Frazier]

Author: dannf
Date: 2009-11-13 22:37:52 +0000 (Fri, 13 Nov 2009)
New Revision: 1599

Added:
   active/CVE-2009-3888
Removed:
   active/CVE-2009-nommu-null-ptrs
Log:
CVE assignment

Copied: active/CVE-2009-3888 (from rev 1598, active/CVE-2009-nommu-null-ptrs)
===================================================================
--- active/CVE-2009-3888	                        (rev 0)
+++ active/CVE-2009-3888	2009-11-13 22:37:52 UTC (rev 1599)
@@ -0,0 +1,24 @@
+Candidate: CVE-2009-3888
+Description:
+ Don't pass NULL pointers to fput() in the error handling paths of the
+ NOMMU do_mmap_pgoff() as it can't handle it.
+ .
+ The following can be used as a test program:
+ int main() { static long long a[1024 * 1024 * 20] = { 0 }; return a;}
+ .
+ Without the patch, the code oopses in atomic_long_dec_and_test() as
+ called by fput() after the kernel complains that it can't allocate
+ that big a chunk of memory.  With the patch, the kernel just complains 
+ about the allocation size and then the program segfaults during execve() 
+ as execve() can't complete the allocation of all the new ELF program 
+ segments.
+References:
+ http://www.openwall.com/lists/oss-security/2009/11/09/2
+ http://xorl.wordpress.com/2009/11/05/linux-kernel-nommu-fput-null-pointer-dereference/
+Notes:
+Bugs:
+upstream: released (2.6.32-rc6) [89a8640279f8bb78aaf778d1fc5c4a6778f18064]
+linux-2.6: needed
+2.6.18-etch-security:
+2.6.24-etch-security:
+2.6.26-lenny-security:

Deleted: active/CVE-2009-nommu-null-ptrs
===================================================================
--- active/CVE-2009-nommu-null-ptrs	2009-11-13 22:36:43 UTC (rev 1598)
+++ active/CVE-2009-nommu-null-ptrs	2009-11-13 22:37:52 UTC (rev 1599)
@@ -1,24 +0,0 @@
-Candidate: requested on oss-sec
-Description:
- Don't pass NULL pointers to fput() in the error handling paths of the
- NOMMU do_mmap_pgoff() as it can't handle it.
- .
- The following can be used as a test program:
- int main() { static long long a[1024 * 1024 * 20] = { 0 }; return a;}
- .
- Without the patch, the code oopses in atomic_long_dec_and_test() as
- called by fput() after the kernel complains that it can't allocate
- that big a chunk of memory.  With the patch, the kernel just complains 
- about the allocation size and then the program segfaults during execve() 
- as execve() can't complete the allocation of all the new ELF program 
- segments.
-References:
- http://www.openwall.com/lists/oss-security/2009/11/09/2
- http://xorl.wordpress.com/2009/11/05/linux-kernel-nommu-fput-null-pointer-dereference/
-Notes:
-Bugs:
-upstream: released (2.6.32-rc6) [89a8640279f8bb78aaf778d1fc5c4a6778f18064]
-linux-2.6: needed
-2.6.18-etch-security:
-2.6.24-etch-security:
-2.6.26-lenny-security: