[kernel] r6637 - in dists/sarge-security/kernel/source/kernel-source-2.6.8-2.6.8/debian: patches patches/series

[Dann Frazier]

Author: dannf
Date: Sat May 20 07:17:55 2006
New Revision: 6637

Added:
   dists/sarge-security/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/do_add_counters-race.dpatch
Modified:
   dists/sarge-security/kernel/source/kernel-source-2.6.8-2.6.8/debian/changelog
   dists/sarge-security/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/series/2.6.8-16sarge3

Log:
* do_add_counters-race.dpatch
  [SECURITY] Fix race condition in the do_add_counters() function in
  netfilter that allows local users with CAP_NET_ADMIN capabilities to
  read kernel memory
  See CVE-2006-0039

Modified: dists/sarge-security/kernel/source/kernel-source-2.6.8-2.6.8/debian/changelog
==============================================================================
--- dists/sarge-security/kernel/source/kernel-source-2.6.8-2.6.8/debian/changelog	(original)
+++ dists/sarge-security/kernel/source/kernel-source-2.6.8-2.6.8/debian/changelog	Sat May 20 07:17:55 2006
@@ -72,8 +72,13 @@
     a portion of the floating point state of other processes, possibly exposing
     sensitive information.
     See CVE-2006-1056
+  * do_add_counters-race.dpatch
+    [SECURITY] Fix race condition in the do_add_counters() function in
+    netfilter that allows local users with CAP_NET_ADMIN capabilities to
+    read kernel memory
+    See CVE-2006-0039
 
- -- dann frazier <dannf at debian.org>  Sat, 20 May 2006 00:48:15 -0500
+ -- dann frazier <dannf at debian.org>  Sat, 20 May 2006 02:15:22 -0500
 
 kernel-source-2.6.8 (2.6.8-16sarge2) stable-security; urgency=high
 

Added: dists/sarge-security/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/do_add_counters-race.dpatch
==============================================================================
--- (empty file)
+++ dists/sarge-security/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/do_add_counters-race.dpatch	Sat May 20 07:17:55 2006
@@ -0,0 +1,58 @@
+Subject: [PATCH] Netfilter: do_add_counters race, possible info leak (CVE-2006-0039)
+
+Solar Designer found a race condition in do_add_counters(). The beginning of
+paddc is supposed to be the same as tmp which was sanity-checked above, but it
+might not be the same in reality. In case the integer overflow and/or the race
+condition are triggered, paddc->num_counters might not match the allocation size
+for paddc. If the check below (t->private->number != paddc->num_counters)
+nevertheless passes (perhaps this requires the race condition to be triggered),
+IPT_ENTRY_ITERATE() would read kernel memory beyond the allocation size,
+potentially leaking sensitive data (e.g., passwords from host system or from
+another VPS) via counter increments.  This requires CAP_NET_ADMIN.
+
+(rebase of Solar's patch to 2.6.16.16)
+
+Signed-off-by: Chris Wright <chrisw at sous-sol.org>
+Cc: Solar Designer <solar at openwall.com>
+Cc: Kirill Korotaev <dev at sw.ru>
+Cc: Patrick McHardy <kaber at trash.net>
+---
+
+# backported to Debian's 2.6.8 by dann frazier <dannf at debian.org>
+
+diff -urN kernel-source-2.6.8.orig/net/ipv4/netfilter/arp_tables.c kernel-source-2.6.8/net/ipv4/netfilter/arp_tables.c
+--- kernel-source-2.6.8.orig/net/ipv4/netfilter/arp_tables.c	2004-08-14 00:38:11.000000000 -0500
++++ kernel-source-2.6.8/net/ipv4/netfilter/arp_tables.c	2006-05-20 02:07:36.365885224 -0500
+@@ -1006,7 +1006,7 @@
+ 		goto free;
+ 
+ 	write_lock_bh(&t->lock);
+-	if (t->private->number != paddc->num_counters) {
++	if (t->private->number != tmp.num_counters) {
+ 		ret = -EINVAL;
+ 		goto unlock_up_free;
+ 	}
+diff -urN kernel-source-2.6.8.orig/net/ipv4/netfilter/ip_tables.c kernel-source-2.6.8/net/ipv4/netfilter/ip_tables.c
+--- kernel-source-2.6.8.orig/net/ipv4/netfilter/ip_tables.c	2004-08-14 00:36:32.000000000 -0500
++++ kernel-source-2.6.8/net/ipv4/netfilter/ip_tables.c	2006-05-20 02:08:04.739571768 -0500
+@@ -1197,7 +1197,7 @@
+ 		goto free;
+ 
+ 	write_lock_bh(&t->lock);
+-	if (t->private->number != paddc->num_counters) {
++	if (t->private->number != tmp.num_counters) {
+ 		ret = -EINVAL;
+ 		goto unlock_up_free;
+ 	}
+diff -urN kernel-source-2.6.8.orig/net/ipv6/netfilter/ip6_tables.c kernel-source-2.6.8/net/ipv6/netfilter/ip6_tables.c
+--- kernel-source-2.6.8.orig/net/ipv6/netfilter/ip6_tables.c	2004-08-14 00:37:40.000000000 -0500
++++ kernel-source-2.6.8/net/ipv6/netfilter/ip6_tables.c	2006-05-20 02:06:39.695500432 -0500
+@@ -1279,7 +1279,7 @@
+ 		goto free;
+ 
+ 	write_lock_bh(&t->lock);
+-	if (t->private->number != paddc->num_counters) {
++	if (t->private->number != tmp.num_counters) {
+ 		ret = -EINVAL;
+ 		goto unlock_up_free;
+ 	}

Modified: dists/sarge-security/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/series/2.6.8-16sarge3
==============================================================================
--- dists/sarge-security/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/series/2.6.8-16sarge3	(original)
+++ dists/sarge-security/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/series/2.6.8-16sarge3	Sat May 20 07:17:55 2006
@@ -19,4 +19,5 @@
 + amd64-fp-reg-leak-dep1.dpatch
 + amd64-fp-reg-leak-dep2.dpatch
 + amd64-fp-reg-leak-dep3.dpatch
-+ amd64-fp-reg-leak.dpatch
\ No newline at end of file
++ amd64-fp-reg-leak.dpatch
++ do_add_counters-race.dpatch