[kernel] r10472 - in dists/etch-security/linux-2.6/debian: . patches/bugfix patches/bugfix/all/vserver patches/series

[Bastian Blank]

Author: waldi
Date: Sun Feb 10 17:31:07 2008
New Revision: 10472

Log:
* [SECURITY] Fix missing access check in vmsplice.
* [SECURITY][vserver] Fix access checks for the links in /proc/$pid.

* debian/changelog: Update.
* debian/patches/bugfix/all/vserver/proc-link-security.patch,
  debian/patches/bugfix/vmsplice-security.patch: Add.
* debian/patches/series/18etch1, debian/patches/series/18etch1-extra:
  Add patches.


Added:
   dists/etch-security/linux-2.6/debian/patches/bugfix/all/vserver/proc-link-security.patch
   dists/etch-security/linux-2.6/debian/patches/bugfix/vmsplice-security.patch
   dists/etch-security/linux-2.6/debian/patches/series/18etch1
   dists/etch-security/linux-2.6/debian/patches/series/18etch1-extra
Modified:
   dists/etch-security/linux-2.6/debian/changelog

Modified: dists/etch-security/linux-2.6/debian/changelog
==============================================================================
--- dists/etch-security/linux-2.6/debian/changelog	(original)
+++ dists/etch-security/linux-2.6/debian/changelog	Sun Feb 10 17:31:07 2008
@@ -1,3 +1,13 @@
+linux-2.6 (2.6.18.dfsg.1-18etch1) UNRELEASED; urgency=low
+
+  * bugfix/vmsplice-security.patch
+    [SECURITY] Fix missing access check in vmsplice.
+    See CVE-2008-0010, CVE-2008-0600
+  * bugfix/all/vserver/proc-link-security.patch
+    [SECURITY][vserver] Fix access checks for the links in /proc/$pid.
+
+ -- Bastian Blank <waldi at debian.org>  Sun, 10 Feb 2008 11:45:36 +0100
+
 linux-2.6 (2.6.18.dfsg.1-18) stable; urgency=high
 
   [ Martin Michlmayr ]

Added: dists/etch-security/linux-2.6/debian/patches/bugfix/all/vserver/proc-link-security.patch
==============================================================================
--- (empty file)
+++ dists/etch-security/linux-2.6/debian/patches/bugfix/all/vserver/proc-link-security.patch	Sun Feb 10 17:31:07 2008
@@ -0,0 +1,11 @@
+--- linux-2.6.22/kernel/ptrace.c	2007-07-09 13:20:03 +0200
++++ linux-2.6.22-vs2.2.0-rc5/kernel/ptrace.c	2007-06-15 04:28:02 +0200
+@@ -145,6 +146,8 @@ static int may_attach(struct task_struct
+ 		dumpable = task->mm->dumpable;
+ 	if (!dumpable && !capable(CAP_SYS_PTRACE))
+ 		return -EPERM;
++	if (!vx_check(task->xid, VX_ADMIN|VX_IDENT))
++		return -EPERM;
+ 
+ 	return security_ptrace(current, task);
+ }

Added: dists/etch-security/linux-2.6/debian/patches/bugfix/vmsplice-security.patch
==============================================================================
--- (empty file)
+++ dists/etch-security/linux-2.6/debian/patches/bugfix/vmsplice-security.patch	Sun Feb 10 17:31:07 2008
@@ -0,0 +1,28 @@
+diff --git a/fs/splice.c b/fs/splice.c
+index 684bca3..2d7e598 100644
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -1122,6 +1122,11 @@ static int get_iovec_page_array(const struct iovec __user *iov,
+ 		size_t len;
+ 		int i;
+ 
++		if (!access_ok(VERIFY_READ, iov, sizeof(struct iovec))) {
++			error = -EFAULT;
++			break;
++		}
++
+ 		/*
+ 		 * Get user address base and length for this iovec.
+ 		 */
+@@ -1141,6 +1146,11 @@ static int get_iovec_page_array(const struct iovec __user *iov,
+ 		if (unlikely(!base))
+ 			break;
+ 
++		if (!access_ok(VERIFY_READ, base, len)) {
++			error = -EFAULT;
++			break;
++		}
++
+ 		/*
+ 		 * Get this base offset and number of pages, then map
+ 		 * in the user pages.

Added: dists/etch-security/linux-2.6/debian/patches/series/18etch1
==============================================================================
--- (empty file)
+++ dists/etch-security/linux-2.6/debian/patches/series/18etch1	Sun Feb 10 17:31:07 2008
@@ -0,0 +1 @@
++ bugfix/vmsplice-security.patch

Added: dists/etch-security/linux-2.6/debian/patches/series/18etch1-extra
==============================================================================
--- (empty file)
+++ dists/etch-security/linux-2.6/debian/patches/series/18etch1-extra	Sun Feb 10 17:31:07 2008
@@ -0,0 +1 @@
++ bugfix/all/vserver/proc-link-security.patch *_vserver *_xen-vserver