CVE-2012-2745: Buffer Overflow
First published: Tue Jun 19 2012(Updated: )
keyctl_session_to_parent(task) sets ->replacement_session_keyring, it should be processed and cleared by key_replace_session_keyring(). However, this task can fork before it notices TIF_NOTIFY_RESUME and the new child gets the bogus ->replacement_session_keyring copied by dup_task_struct(). This is obviously wrong and, if nothing else, this leads to put_cred(already_freed_cred). This causes the following panic on ppc64: Kernel panic - not syncing: CRED: put_cred_rcu() sees c0000001f41a4480 with usage -1 Call Trace: [c0000001fff53bc0] [c000000000012f04] .show_stack+0x74/0x1c0 (unreliable) [c0000001fff53c70] [c0000000005c2d18] .panic+0xb8/0x1ec [c0000001fff53d00] [c0000000000c7858] .put_cred_rcu+0x118/0x120 [c0000001fff53d80] [c000000000117708] .__rcu_process_callbacks+0x158/0x3f0 [c0000001fff53e30] [c0000000001179d4] .rcu_process_callbacks+0x34/0x70 [c0000001fff53eb0] [c00000000009cb18] .__do_softirq+0x118/0x290 [c0000001fff53f90] [c000000000031e28] .call_do_softirq+0x14/0x24 [c0000001fcf7b990] [c00000000000e700] .do_softirq+0xf0/0x110 [c0000001fcf7ba30] [c00000000009c834] .irq_exit+0xb4/0xc0 [c0000001fcf7bab0] [c00000000002e3b8] .timer_interrupt+0x108/0x160 [c0000001fcf7bb40] [c000000000003718] decrementer_common+0x118/0x180 --- Exception: 901 at .raw_local_irq_restore+0x54/0x60 LR = .cpu_idle+0x14c/0x1d0 Because powerpc does not, currently, call key_replace_session_keyring() from the TIF_NOTIFY_RESUME handler. i386, x86_64, s390 and ia64 all do call the keyrings code and so the attack window is much smaller - though still present. An unprivileged local user could use this flaw to crash the system. Introduced by: <a href="http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ee18d64c">http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ee18d64c</a> Upstream commit: <a href="http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=79549c6dfda0603dba9a70a53467ce62d9335c33">http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=79549c6dfda0603dba9a70a53467ce62d9335c33</a>
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Linux kernel | <=3.3.1 | |
| Linux Linux kernel | =3.3 | |
| Linux Linux kernel | =3.3-rc1 | |
| Linux Linux kernel | =3.3-rc2 | |
| Linux Linux kernel | =3.3-rc3 | |
| Linux Linux kernel | =3.3-rc4 | |
| Linux Linux kernel | =3.3-rc5 | |
| Linux Linux kernel | =3.3-rc6 | |
| Linux Linux kernel | =3.3-rc7 | |
| debian/linux | 5.10.223-1 5.10.226-1 6.1.115-1 6.1.112-1 6.11.5-1 6.11.7-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=79549c6dfda0603dba9a70a53467ce62d9335c33
- http://rhn.redhat.com/errata/RHSA-2012-1064.html
- http://secunia.com/advisories/50633
- http://secunia.com/advisories/50853
- http://secunia.com/advisories/50961
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.3.2
- http://www.securityfocus.com/bid/54365
- http://www.securitytracker.com/id?1027236
- http://www.ubuntu.com/usn/USN-1567-1
- http://www.ubuntu.com/usn/USN-1597-1
- http://www.ubuntu.com/usn/USN-1606-1
- https://bugzilla.redhat.com/show_bug.cgi?id=833428
- https://github.com/torvalds/linux/commit/79549c6dfda0603dba9a70a53467ce62d9335c33
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ee18d64c
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=79549c6dfda0603dba9a70a53467ce62d9335c33
- https://rhn.redhat.com/errata/RHSA-2012-1064.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=838890
- https://launchpad.net/bugs/cve/CVE-2012-2745
- https://security-tracker.debian.org/tracker/CVE-2012-2745
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2745
- https://nvd.nist.gov/vuln/detail/CVE-2012-2745
- https://ubuntu.com/security/CVE-2012-2745
- collector/nvd-index
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2012-2745
- collector/launchpad-cve
- source/Launchpad
- agent/author
- agent/weakness
- agent/severity
- agent/remedy
- agent/description
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/event
- agent/references
- agent/tags
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/usn-cve
- source/Ubuntu
- vendor/linux
- canonical/linux linux kernel
- version/linux linux kernel/3.3.1
- version/linux linux kernel/3.3
- version/linux linux kernel/3.3-rc1
- version/linux linux kernel/3.3-rc2
- version/linux linux kernel/3.3-rc3
- version/linux linux kernel/3.3-rc4
- version/linux linux kernel/3.3-rc5
- version/linux linux kernel/3.3-rc6
- version/linux linux kernel/3.3-rc7
- package-manager/debian