[kernel] r5243 - in dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian: . patches patches/series

[Simon Horman]

Author: horms
Date: Thu Jan  5 03:11:30 2006
New Revision: 5243

Added:
   dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/dm-crypt-zero-key.dpatch
Modified:
   dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/changelog
   dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/series/2.6.8-17
Log:
  * dm-crypt-zero-key.dpatch
    [SECURITY] drm-crypt: zero key berofe freeing it.
    Potential local information leak
    CVE-NOMATCH

Modified: dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/changelog
==============================================================================
--- dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/changelog	(original)
+++ dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/changelog	Thu Jan  5 03:11:30 2006
@@ -342,12 +342,17 @@
     See CVS-2005-4605
     From 2.6.15
 
+  * dm-crypt-zero-key.dpatch
+    [SECURITY] drm-crypt: zero key berofe freeing it. 
+    Potential local information leak
+    CVE-NOMATCH
+
   [ dann frazier ]
   * mempolicy-check-mode.dpatch
     [SECURITY] Input validation in sys_set_mempolicy(); local DoS.
     See CAN-2005-3053
 
- -- Simon Horman <horms at verge.net.au>  Wed,  4 Jan 2006 16:14:43 +0900
+ -- Simon Horman <horms at verge.net.au>  Thu,  5 Jan 2006 11:59:34 +0900
 
 kernel-source-2.6.8 (2.6.8-16) unstable; urgency=low
 

Added: dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/dm-crypt-zero-key.dpatch
==============================================================================
--- (empty file)
+++ dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/dm-crypt-zero-key.dpatch	Thu Jan  5 03:11:30 2006
@@ -0,0 +1,46 @@
+Date: Thu, 5 Jan 2006 01:47:10 +0100
+To: horms at debian.org, dannf at debian.org, micah at riseup.net
+Cc: team at security.debian.org
+Subject: Fwd: [Patch 2.6] dm-crypt: zero key before freeing it
+Message-ID: <20060105004709.GA5494 at informatik.uni-bremen.de>
+From: Moritz Muehlenhoff <jmm at inutil.org>
+
+Horms/Dann,
+I found this on linux-kernel. I guess we should include this in linux-2.6
+and (if applicable, haven't checked yet) to 2.6.8.
+
+Cheers,
+        Moritz
+
+From: Stefan Rompf <stefan at loplof.de>
+Newsgroups: gmane.linux.kernel
+Subject: [Patch 2.6] dm-crypt: zero key before freeing it
+
+Hi Andrew,
+
+dm-crypt does not clear struct crypt_config before freeing it. Thus, 
+information on the key could leak f.e. to a swsusp image even after the 
+encrypted device has been removed. The attached patch against 2.6.14 / 2.6.15 
+fixes it.
+
+Signed-off-by: Stefan Rompf <stefan at loplof.de>
+Acked-by: Clemens Fruhwirth <clemens at endorphin.org>
+
+--- linux-2.6.14.4/drivers/md/dm-crypt.c.old	2005-12-16 18:27:05.000000000 +0100
++++ linux-2.6.14.4/drivers/md/dm-crypt.c	2005-12-28 12:49:13.000000000 +0100
+@@ -694,6 +694,7 @@ bad3:
+ bad2:
+ 	crypto_free_tfm(tfm);
+ bad1:
++	memset(cc, 0, sizeof(*cc) + cc->key_size * sizeof(u8));
+ 	kfree(cc);
+ 	return -EINVAL;
+ }
+@@ -710,6 +711,7 @@ static void crypt_dtr(struct dm_target *
+ 		cc->iv_gen_ops->dtr(cc);
+ 	crypto_free_tfm(cc->tfm);
+ 	dm_put_device(ti, cc->dev);
++	memset(cc, 0, sizeof(*cc) + cc->key_size * sizeof(u8));
+ 	kfree(cc);
+ }
+ 

Modified: dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/series/2.6.8-17
==============================================================================
--- dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/series/2.6.8-17	(original)
+++ dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/series/2.6.8-17	Thu Jan  5 03:11:30 2006
@@ -83,3 +83,4 @@
 + fs-lock-lease-log-spam.dpatch
 + mempolicy-undefined-nodes.dpatch
 + proc-legacy-loff-underflow.dpatch
++ dm-crypt-zero-key.dpatch