Reported by Tavis Ormandy of Google Security Team. The root cause was determined to be a use-after-free of locked async file descriptors, and it is believed to have been introduced here: http://git.kernel.org/linus/233e70f4228e78eb2f80dc6650f65d3ae3dbf17c
Acknowledgements:
Red Hat would like to thank Tavis Ormandy of Google Security Team for reporting this issue.
A flaw was found in the way Linux kernel's XFS filesystem implementation handled links with pathname larger than MAXPATHLEN. When CONFIGXFSDEBUG configuration option was not enabled when compiling Linux kernel, an attacker able to mount malicious XFS image could use this flaw to crash the system, or potentially, elevate his privileges on that system.
Proposed upstream patch: http://oss.sgi.com/archives/xfs/2011-10/msg00345.html
Description of problem: commit dce766af541f6605fa9889892c0280bab31c66ab Author: Florian Westphal <fwestphal> Date: Fri Jan 8 17:31:24 2010 +0100
netfilter: ebtables: enforce CAPNETADMIN normal users are currently allowed to set/modify ebtables rules. Restrict it to processes with CAPNETADMIN. Note that this cannot be reproduced with unmodified ebtables binary because it uses SOCKRAW. Signed-off-by: Florian Westphal <fwestphal> Cc: stable Signed-off-by: Patrick McHardy <kaber>
Upstream commit: http://git.kernel.org/linus/dce766af541f6605fa9889892c0280bab31c66ab
Buffer overflow in the lbsprocessbss function in drivers/net/wireless/libertas/scan.c in the libertas subsystem in the Linux kernel before 2.6.27.5 allows remote attackers to have an unknown impact via an "invalid beacon/probe response."
The pppol2tprecvmsg function in drivers/net/pppol2tp.c in the Linux kernel 2.6 before 2.6.26-rc6 allows remote attackers to cause a denial of service (kernel heap memory corruption and system crash) and possibly have unspecified other impact via a crafted PPPOL2TP packet that results in a large value for a certain length variable.
The (1) sparcmmapcheck function in arch/sparc/kernel/syssparc.c and the (2) sparc64mmapcheck function in arch/sparc64/kernel/syssparc.c, in the Linux kernel 2.4 before 2.4.36.5 and 2.6 before 2.6.25.3, omit some virtual-address range (aka span) checks when the mmap MAPFIXED bit is not set, which allows local users to cause a denial of service (panic) via unspecified mmap calls.
Memory leak in the ipip6rcv function in net/ipv6/sit.c in the Linux kernel 2.4 before 2.4.36.5 and 2.6 before 2.6.25.3 allows remote attackers to cause a denial of service (memory consumption) via network traffic to a Simple Internet Transition (SIT) tunnel interface, related to the pskbmaypull and kfreeskb functions, and management of an skb reference count.
The bdxioctlpriv function in the tehuti driver (tehuti.c) in Linux kernel 2.6.x before 2.6.25.1 does not properly check certain information related to register size, which has unspecified impact and local attack vectors, probably related to reading or writing kernel memory.
Linux kernel before 2.6.25.2 does not apply a certain protection mechanism for fcntl functionality, which allows local users to (1) execute code in parallel or (2) exploit a race condition to obtain "re-ordered access to the descriptor table."
Race condition in the directory notification subsystem (dnotify) in Linux kernel 2.6.x before 2.6.24.6, and 2.6.25 before 2.6.25.1, allows local users to cause a denial of service (OOPS) and possibly gain privileges via unspecified vectors.
VFS in the Linux kernel before 2.6.22.16, and 2.6.23.x before 2.6.23.14, performs tests of access mode by using the flag variable instead of the accmode variable, which might allow local users to bypass intended permissions and remove directories.
Linux kernel 2.6, when using vservers, allows local users to access resources of other vservers via a symlink attack in /proc.
The ext4decodeerror function in fs/ext4/super.c in the ext4 filesystem in the Linux kernel before 2.6.32 allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference), and possibly have unspecified other impact, via a crafted read-only filesystem that lacks a journal.
Description of problem: ext4: avoid divide by zero when trying to mount a corrupted file system If sloggroupsperflex is greater than 31, then groupsperflex will overflow and cause a divide by zero error. This can cause kernel BUG if such a file system is mounted. Upstream commit: http://git.kernel.org/linus/503358ae01b70ce6909d19dd01287093f6b6271c
References: http://bugzilla.kernel.org/showbug.cgi?id=14287 http://secunia.com/advisories/37658
Description of problem: Name: CVE-2009-4306 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4306 Final-Decision: Interim-Decision: Modified: Proposed: Assigned: 20091212 Category: Reference: MISC:http://grsecurity.org/test/grsecurity-2.1.14-2.6.32-200912112157.patch Reference: MISC:http://twitter.com/fotisl/statuses/6568947714 Reference: MISC:http://twitter.com/spendergrsec/statuses/6551797457 Reference: MISC:http://twitter.com/spendergrsec/statuses/6567167692 Reference: MISC:http://twitter.com/spendergrsec/statuses/6569596339 Reference: MISC:http://twitter.com/spendergrsec/statuses/6572069107 Reference: MISC:http://twitter.com/spendergrsec/statuses/6583954567 Reference: MISC:http://twitter.com/tytso/statuses/6571730411
Unspecified vulnerability in the EXT4IOCMOVEEXT (aka move extents) ioctl implementation in the ext4 filesystem in the Linux kernel 2.6.32-git6 and earlier allows local users to cause a denial of service (filesystem corruption) via unknown vectors, a different vulnerability than CVE-2009-4131.
Description of problem: From 910123ba363623f15ffb5d05dd87bdf06d08c609 Mon Sep 17 00:00:00 2001 From: Akira Fujita <a-fujita.nec.com> Date: Sun, 6 Dec 2009 23:38:31 -0500 Subject: [PATCH] ext4: Fix insufficient checks in EXT4IOCMOVEEXT
This patch fixes three problems in the handling of the EXT4IOCMOVEEXT ioctl:
1. In current EXT4IOCMOVEEXT, there are read access mode checks for original and donor files, but they allow the illegal write access to donor file, since donor file is overwritten by original file data. To fix this problem, change access mode checks of original (r->r/w) and donor (r->w) files.
2. Disallow the use of donor files that have a setuid or setgid bits.
3. Call mntwantwrite() and mntdropwrite() before and after ext4moveextents() calling to get write access to a mount.
Signed-off-by: Akira Fujita <a-fujita.nec.com> Signed-off-by: "Theodore Ts'o" <tytso> --- fs/ext4/ioctl.c | 30 ++++++++++++++++++------------ fs/ext4/moveextent.c | 7 +++++++ 2 files changed, 25 insertions(+), 12 deletions(-)
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c index 31e5ee0..b63d193 100644 --- a/fs/ext4/ioctl.c +++ b/fs/ext4/ioctl.c @@ -221,32 +221,38 @@ setversionout: struct file donorfilp; int err; + if (!(filp->fmode & FMODEREAD) || + !(filp->fmode & FMODEWRITE)) + return -EBADF; + if (copyfromuser(&me, (struct moveextent user )arg, sizeof(me))) return -EFAULT; + me.movedlen = 0; donorfilp = fget(me.donorfd); if (!donorfilp) return -EBADF; - if (!capable(CAPDACOVERRIDE)) { - if ((current->realcred->fsuid != inode->iuid) || - !(inode->imode & SIRUSR) || - !(donorfilp->fdentry->dinode->imode & - SIRUSR)) { - fput(donorfilp); - return -EACCES; - } + if (!(donorfilp->fmode & FMODEWRITE)) { + err = -EBADF; + goto mextout; } - me.movedlen = 0; + err = mntwantwrite(filp->fpath.mnt); + if (err) + goto mextout; + err = ext4moveextents(filp, donorfilp, me.origstart, me.donorstart, me.len, &me.movedlen); - fput(donorfilp); + mntdropwrite(filp->fpath.mnt); + if (me.movedlen > 0) + fileremovesuid(donorfilp); if (copytouser((struct moveextent )arg, &me, sizeof(me))) - return -EFAULT; - + err = -EFAULT; +mextout: + fput(donorfilp); return err; } diff --git a/fs/ext4/moveextent.c b/fs/ext4/moveextent.c index cad1e2e..82c415b 100644 --- a/fs/ext4/moveextent.c +++ b/fs/ext4/moveextent.c @@ -957,6 +957,13 @@ mextcheckarguments(struct inode originode, return -EINVAL; } + if (donorinode->imode & (SISUID|SISGID)) { + ext4debug("ext4 move extent: suid or sgid is set" + " to donor file [ino:orig %lu, donor %lu]\n", + originode->iino, donorinode->iino); + return -EINVAL; + } + / Ext4 move extent does not support swapfile / if (ISSWAPFILE(originode) || ISSWAPFILE(donorinode)) { ext4debug("ext4 move extent: The argument files should " -- 1.6.5.216.g5288a.dirty
Description of problem: Jay Fenlason reported that anyone who can open any of the /dev/fw files on recent version of the new firewire stack can crash machines with ohci 1.0 controllers (or ohci 1.1 controllers that are being used in ohci 1.0 mode because of hardware bugs) by issuing certain ioctls. This causes a null pointer reference in {fw-,}ohci.c.
On machines with non-blacklisted ohci1.1 controllers, the call does nothing, which is a bug, but doesn't crash.
On Red Hat Enterprise Linux 5, the firewire modules are blacklisted by default, and if they are enabled, the default ownership of the /dev/fw nodes is root:root.
https://patchwork.kernel.org/patch/66747/
Race condition in the mac80211 subsystem in the Linux kernel before 2.6.32-rc8-next-20091201 allows remote attackers to cause a denial of service (system crash) via a Delete Block ACK (aka DELBA) packet that triggers a certain state change in the absence of an aggregation session.
The collectrxframe function in drivers/isdn/hisax/hfcusb.c in the Linux kernel before 2.6.32-rc7 allows attackers to have an unspecified impact via a crafted HDLC packet that arrives over ISDN and triggers a buffer under-read.
Description of problem: fusedirectio() has a loop where requests are allocated in each iteration. if allocation fails, the loop is broken out and follows into an unconditional fuseputrequest() on that invalid pointer."
Upstream commit: http://git.kernel.org/linus/f60311d5f7670d9539b424e4ed8b5c0872fc9e83
This can be triggered when the system is low on memory, and when the fuserequestalloc() function called from fusegetreq() fails. The fuseputrequest() function will then dereference the invalid pointer returned, resulting in a kernel oops.
This was introduced in 413ef8cb (v2.6.14-rc1) and fixed in v2.6.32-rc7.
Lennert Buytenhek noticed that delBA handling in mac80211 was broken and has remotely triggerable problems, some of which are due to some code shuffling I did that ended up changing the order in which things were done -- this was
commit d75636ef9c1af224f1097941879d5a8db7cd04e5 Author: Johannes Berg <johannes> Date: Tue Feb 10 21:25:53 2009 +0100
mac80211: RX aggregation: clean up stop session
and other parts were already present in the original
commit d92684e66091c0f0101819619b315b4bb8b5bcc5 Author: Ron Rindjunsky <ron.rindjunsky> Date: Mon Jan 28 14:07:22 2008 +0200
mac80211: A-MPDU Tx add delBA from recipient support
The first problem is that I moved a BUGON before various checks -- thereby making it possible to hit. As the comment indicates, the BUGON can be removed since the ampduaction callback must already exist when the state is != IDLE.
The second problem isn't easily exploitable but there's a race condition due to unconditionally setting the state to OPERATIONAL when a delBA frame is received, even when no aggregation session was ever initiated. All the drivers accept stopping the session even then, but that opens a race window where crashes could happen before the driver accepts it. Right now, a WARNON may happen with non-HT drivers, while the race opens only for HT drivers.
For this case, there are two things necessary to fix it: 1) don't process spurious delBA frames, and be more careful about the session state; don't drop the lock
2) HT drivers need to be prepared to handle a session stop even before the session was really started -- this is true for all drivers (that support aggregation) but iwlwifi which can be fixed easily. The other HT drivers (ath9k and ar9170) are behaving properly already.
The pollmodeio file for the megaraidsas driver in the Linux kernel 2.6.31.6 and earlier has world-writable permissions, which allows local users to change the I/O mode of the driver by modifying this file.
Description of problem: The megaraidsas driver exposes a number of driver attributes in sysfs. Many of these are read-only, just export information from the driver and are world-readable.
A couple of attributes are writable and may be used to change the behaviour of the driver (e.g. setting debug logging levels, selecting poll vs. interrupt I/O mode etc).
Some of these writable attributes are mistakenly created with world-writable permissions, e.g. dbglvl and pollmodeio:
rw-rw-rw- root root /sys/bus/pci/drivers/megaraidsas/dbglvl rw-rw-rw- root root /sys/bus/pci/drivers/megaraidsas/pollmodeio
$ grep 'DRIVERATTR.SIWUGO' drivers/scsi/megaraid/megaraidsas.c static DRIVERATTR(dbglvl, SIRUGO|SIWUGO, megasassysfsshowdbglvl, static DRIVERATTR(pollmodeio, SIRUGO|SIWUGO,
This would allow an unprivileged user to affect kernel driver behaviour and logging level.
Version-Release number of selected component (if applicable): 2.6.18-.el5
How reproducible: 100%
Steps to Reproduce: (On a system with megaraidsas loaded) 1. ls -l /sys/bus/pci/drivers/megaraidsas/dbglvl 2. ls -l /sys/bus/pci/drivers/megaraidsas/pollmodeio
Actual results: rw-rw-rw- root root /sys/bus/pci/drivers/megaraidsas/dbglvl rw-rw-rw- root root /sys/bus/pci/drivers/megaraidsas/pollmodeio
Expected results: rw------- root root /sys/bus/pci/drivers/megaraidsas/dbglvl rw------- root root /sys/bus/pci/drivers/megaraidsas/pollmodeio
Additional info:
Upstream made the dbdlvl permissions more restrictive:
commit 66dca9b8c50b5e59d3bea8b21cee5c6dae6c9c46 Author: Joe Malicki <jmalicki> Date: Thu Aug 14 17:14:48 2008 -0400
[SCSI] megaraidsas: remove sysfs dbglvl world writeable permissions /sys/bus/pci/drivers/megaraidsas/dbglvl defaults to being world-writable, which seems bad (letting any user affect kernel driver behavior and logging level). This turns off group and user write permissions, so that on typical production systems only root can write to it. [jejb: fix up rejections] Signed-off-by: Joseph Malicki <jmalicki> Acked-by: "Yang, Bo" <Bo.Yang> Signed-off-by: James Bottomley <James.Bottomley>
The pollmodeio pseudofile still has world-writable permissions upstream.
The dommappgoff function in mm/nommu.c in the Linux kernel before 2.6.31.6, when the CPU lacks a memory management unit, allows local users to cause a denial of service (OOPS) via an application that attempts to allocate a large amount of memory.
Hi,
Description of problem:
execution of a particular program from the Arachne suite reliably causes a kernel panic due to a NULL-pointer dereference in nfs4proclock().
Version-Release number of selected component (if applicable):
2.6.18-164.2.1.el5
How reproducible:
always on NFSv4 mounted directories
Steps to Reproduce: 1. wget http://www.genoscope.cns.fr/externe/redhat/XMLMissingField 2. Save a copy on an NFSv4-mounted directory 3. Execute it Actual results:
Kernel panic
Expected results:
No panic
Additional info:
Console output:
Unable to handle kernel NULL pointer dereference at 0000000000000030 RIP: [<ffffffff8837b210>] :nfs:nfs4proclock+0x21f/0x3ad PGD 1026eec067 PUD 1026f2f067 PMD 0 Oops: 0000 [1] SMP last sysfs file: /block/dm-1/range CPU 0 Modules linked in: ipmidevintf ipmisi ipmimsghandler nfs lockd fscache nfsacl sunrpc bonding ipv6 xfrmnalgo cryptoapi video hwmon backlight sbs i2cec button battery asusacpi acpimemhotplug ac joydev sg shpchp i2cnforce2 i2ccore forcedeth dmsnapshot dmzero dmmod satanv libata mptsas mptscsih mptbase scsitransportsas sdmod scsimod ext3 jbd uhcihcd ohcihcd ehcihcd Pid: 4070, comm: XMLMissingField Not tainted 2.6.18-164.2.1.el5 #1 RIP: 0010:[<ffffffff8837b210>] [<ffffffff8837b210>] :nfs:nfs4proclock+0x21f/0x3ad RSP: 0018:ffff810819bdbdd8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff810827c52088 RSI: 0000000000000006 RDI: ffff810819bdbe38 RBP: ffff81081a6dfdc0 R08: 0000000000000001 R09: ffff810819bdbd68 R10: ffff810819bdbd68 R11: 00000000000000d0 R12: ffff810827c52088 R13: 0000000000000000 R14: ffff810819a9b930 R15: 0000000000000006 FS: 00002b97d31fc7b0(0000) GS:ffffffff803c1000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000030 CR3: 00000010268cb000 CR4: 00000000000006e0 Process XMLMissingField (pid: 4070, threadinfo ffff810819bda000, task ffff810827d6a7e0) Stack: 00000000000003e8 0000000000000000 ffff810819a9b930 ffffffff88373e4f 0000000000000000 0000000000000000 0000000000000000 0000000019a9ba40 ffff810819bdbe18 ffff810819bdbe18 0000000000000000 0000000000000000 Call Trace: [<ffffffff88373e4f>] :nfs:nfssyncinodewait+0x116/0x1db [<ffffffff8836a226>] :nfs:dosetlk+0x55/0x8c [<ffffffff80039e72>] fcntlsetlk+0x11e/0x273 [<ffffffff800b66fa>] auditsyscallentry+0x180/0x1b3 [<ffffffff8002e5bb>] sysfcntl+0x269/0x2dc [<ffffffff8005d28d>] tracesys+0xd5/0xe0
Code: 49 8b 45 30 4c 89 e6 4c 89 ef 45 8a 74 24 58 48 8b 40 18 48 RIP [<ffffffff8837b210>] :nfs:nfs4proclock+0x21f/0x3ad RSP <ffff810819bdbdd8> CR2: 0000000000000030 <0>Kernel panic - not syncing: Fatal exception
Also see http://www.spinics.net/linux/lists/linux-nfs/msg03357.html
Quote from the upstream commit: Debug registers may only be accessed from cpl 0. Unfortunately, vmx will code to emulate the instruction even though it was issued from guest userspace, possibly leading to an unexpected trap later.
Introduced in v2.6.30-rc1; Fixed in v2.6.32-rc1.
http://git.kernel.org/linus/0a79b009525b160081d75cef5dbf45817956acf2
The updatecr8intercept function in arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel before 2.6.32-rc1 does not properly handle the absence of an Advanced Programmable Interrupt Controller (APIC), which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via a call to the kvmvcpuioctl function.
Quoting from upstream patch: On setting up the callback to the client, we attempt to use the same authentication flavor the client did. We find an rpc cred to use by calling rpcauthlookupcredcache(), which assumes that the given authentication flavor has a credentials cache. However, this is not required to be true--in particular, authnull does not use one. Instead, we should call the auth's lookupcred() method.
Without this, a client attempting to mount using nfsv4 and authnull triggers a null dereference.
The code was introduced in upstream commit 3cef9ab2 (v2.6.31-rc1), fixed in 886e3b7f (v2.6.32-rc1), and was later replaced by 80fc015b.
Integer overflow in the kvmdevioctlgetsupportedcpuid function in arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel before 2.6.31.4 allows local users to have an unspecified impact via a KVMGETSUPPORTEDCPUID request to the kvmarchdevioctl function.
The getinstantiationkeyring function in security/keys/keyctl.c in the KEYS subsystem in the Linux kernel before 2.6.32-rc5 does not properly maintain the reference count of a keyring, which allows local users to gain privileges or cause a denial of service (OOPS) via vectors involving calls to this function without specifying a keyring by ID, as demonstrated by a series of keyctl request2 and keyctl list commands.