CVE-2008-1514: Medium severity linux kernel vulnerability
arch/s390/kernel/ptrace.c in Linux kernel 2.6.9, and other versions before 2.6.27-rc6, on s390 platforms allows local users to cause a denial of service (kernel panic) via the user-area-padding test from the ptrace testsuite in 31-bit mode, which triggers an invalid dereference.
Other sources
Description of problem:
Jan Kratochvil has reported the following kernel ptrace related issue:
Description of problem: Accidentally found one can crash the kernel. No root privileges are needed.
Version-Release number of selected component (if applicable): kernel-2.6.9-68.19.EL.s390 kernel-2.6.9-68.19.EL.s390x (for -m31 binaries)
How reproducible: Always.
Steps to Reproduce: 1. wget -O user-area-padding.c 'http://sources.redhat.com/cgi-bin/cvsweb.cgi/~checkout~/tests/ptrace-tests/tests/user-area-padding.c?cvsroot=systemtap' 2. gcc -o user-area-padding user-area-padding.c -Wall -ggdb2 -DGNUSOURCE -m31 3. ./user-area-padding
Actual results:
Kernel 2.6.9-68.19.EL on an s390x
z205 login: 03/18/08 03:16:06 JobID:17819 Test:/distribution/reservesys Unable to handle kernel pointer dereference at virtual kernel address 000000008c 8d8000 Oops: 003b Ý#1¨ CPU: 1 Not tainted Process user-area-paddi (pid: 12275, task: 000000001c008040, ksp: 0000000010ba7c 60) Krnl PSW : 0700200180000000 00000000000ff58a (exitsem+0x26/0x1bc) Krnl GPRS: 0000000000200200 0000000000000001 000000001c008040 0000000000000002 0000000000040ef4 00000000008fa480 0000000010ba7f58 0000000010ba7e88 0000000000000001 0000000000000009 000000001c008040 000000001c7e5b58 000000008c8d8e8f 0000000000206ca8 0000000010ba7c60 0000000010ba7c20 Krnl Code: 58 20 c0 00 18 32 1b 31 ba 23 c0 00 a7 44 ff fc 12 33 a7 74 Call Trace: (Ý<000000001c7e5b58>¨ 0x1c7e5b58) Ý<0000000000040efe>¨ doexit+0x382/0xf40 Ý<0000000000041be6>¨ dogroupexit+0xce/0xd0 Ý<000000000004d90a>¨ getsignaltodeliver+0x3a2/0x3d0 Ý<000000000001c4d4>¨ dosignal+0xc0/0x620 Ý<000000000002f27e>¨ syscsigpending+0x12/0x1e Ý<0000000045b905f4>¨ 0x45b905f4
<0>Kernel panic - not syncing: Fatal exception: paniconoops 00: HCPGSP2629I The virtual machine is placed in CP mode due to a SIGP stop from CPU 01. 01: HCPGIR450W CP entered; disabled wait PSW 00020001 80000000 00000000 00017E06
Kernel 2.6.9-68.19.EL on an s390
z203 login: 03/18/08 03:00:25 JobID:17818 Test:/distribution/reservesys specification exception: 0006 Ý#1¨ CPU: 1 Not tainted Process user-area-paddi (pid: 14407, task: 1daee7e8, ksp: 0ad85db8) Krnl PSW : 07081000 800d8740 (exitsem+0x28/0x1a0) Krnl GPRS: 00200200 00000001 fc77d074 fc77d073 8002faf8 1c99fa2c 77ff68e0 1daeeb4c 00000001 00000009 1daee7e8 1eb71d30 8c8d8e8f 800d871e 0ad85dc8 0ad85da0 Krnl Code: a7 44 ff fc 12 33 a7 74 00 9e 18 8c a7 8a 00 08 bf af c0 08 Call Trace: (Ý<000000001daee7e8>¨ 0x1daee7e8) Ý<000000000002fb00>¨ doexit+0x300/0xdb0 Ý<00000000000306be>¨ dogroupexit+0xb6/0xe0 Ý<000000000003ad8c>¨ getsignaltodeliver+0x30/0x380 Ý<000000000001bc6a>¨ dosignal+0xa2/0x55c Ý<000000000002037c>¨ syscsigpending+0x10/0x1c Ý<000000004ec845f4>¨ 0x4ec845f4
<0>Kernel panic - not syncing: Fatal exception: paniconoops 00: HCPGSP2629I The virtual machine is placed in CP mode due to a SIGP stop from CPU 01. 01: HCPGIR450W CP entered; disabled wait PSW 000A0000 8001758A
Expected results: 0
Additional info: debugger-on-inferior-on-kernel: s390-on-s390-on-s390: crash s390-on-s390-on-s390x: crash s390x-on-s390x-on-s390x: SKIP (no padding area there) s390x-on-s390-on-s390x: not tested
RHEL-5 does not crash (utrace there) but it returns 1 (FAIL) - Bug 431183.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-1514?
CVE-2008-1514 has a severity rating that qualifies it as a medium risk due to its potential to cause a denial of service on affected systems.
How do I fix CVE-2008-1514?
To fix CVE-2008-1514, upgrade to a patched version of the Linux Kernel that is newer than 2.6.27-rc6.
Which versions are affected by CVE-2008-1514?
CVE-2008-1514 affects multiple versions of the Linux Kernel prior to 2.6.27-rc6, including but not limited to versions starting from 2.6.2 up to and including 2.6.27.
What platforms does CVE-2008-1514 impact?
CVE-2008-1514 specifically impacts local users on s390 platforms.
What type of vulnerability is CVE-2008-1514?
CVE-2008-1514 is classified as a denial of service vulnerability that arises from an invalid dereference in the ptrace subsystem.