drivers/scsi/mpt2sas/mpt2sasctl.c in the Linux kernel 2.6.38 and earlier does not validate (1) length and (2) offset values before performing memory copy operations, which might allow local users to gain privileges, cause a denial of service (memory corruption), or obtain sensitive information from kernel memory via a crafted ioctl call, related to the ctldomptcommand and ctldiagreadbuffer functions.

Reported by Tavis Ormandy of Google Security Team. The root cause was determined to be a use-after-free of locked async file descriptors, and it is believed to have been introduced here: http://git.kernel.org/linus/233e70f4228e78eb2f80dc6650f65d3ae3dbf17c

Acknowledgements:

Red Hat would like to thank Tavis Ormandy of Google Security Team for reporting this issue.

Description of problem: While chasing a bug report involving a OS/2 server, I noticed the server sets pSMBr->CountHigh to a incorrect value even in case of normal writes. This results in 'nbytes' being computed wrongly and triggers a kernel BUG at mm/filemap.c. void ioviteradvance(struct ioviter i, sizet bytes) { BUGON(i->count < bytes); <--- BUG here Why the server is setting 'CountHigh' is not clear but only does so after writing 64k bytes. Though this looks like the server bug, the client side crash may not be acceptable. The workaround is to mask off high 16 bits if the number of bytes written as returned by the server is greater than the bytes requested by the client.

Upstream commit: http://git.kernel.org/linus/6513a81e9325d712f1bfb9a1d7b750134e49ff18 (v2.6.34-rc4)

Last updated 25 April 2025

Last updated 25 April 2025

Last updated 11 April 2025

Last updated 25 April 2025

The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.

The pppol2tprecvmsg function in drivers/net/pppol2tp.c in the Linux kernel 2.6 before 2.6.26-rc6 allows remote attackers to cause a denial of service (kernel heap memory corruption and system crash) and possibly have unspecified other impact via a crafted PPPOL2TP packet that results in a large value for a certain length variable.

The bdxioctlpriv function in the tehuti driver (tehuti.c) in Linux kernel 2.6.x before 2.6.25.1 does not properly check certain information related to register size, which has unspecified impact and local attack vectors, probably related to reading or writing kernel memory.

The ext4decodeerror function in fs/ext4/super.c in the ext4 filesystem in the Linux kernel before 2.6.32 allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference), and possibly have unspecified other impact, via a crafted read-only filesystem that lacks a journal.

Description of problem: ext4: avoid divide by zero when trying to mount a corrupted file system If sloggroupsperflex is greater than 31, then groupsperflex will overflow and cause a divide by zero error. This can cause kernel BUG if such a file system is mounted. Upstream commit: http://git.kernel.org/linus/503358ae01b70ce6909d19dd01287093f6b6271c

References: http://bugzilla.kernel.org/showbug.cgi?id=14287 http://secunia.com/advisories/37658

Description of problem: From 910123ba363623f15ffb5d05dd87bdf06d08c609 Mon Sep 17 00:00:00 2001 From: Akira Fujita <a-fujita.nec.com> Date: Sun, 6 Dec 2009 23:38:31 -0500 Subject: [PATCH] ext4: Fix insufficient checks in EXT4IOCMOVEEXT

This patch fixes three problems in the handling of the EXT4IOCMOVEEXT ioctl:

1. In current EXT4IOCMOVEEXT, there are read access mode checks for original and donor files, but they allow the illegal write access to donor file, since donor file is overwritten by original file data. To fix this problem, change access mode checks of original (r->r/w) and donor (r->w) files.

2. Disallow the use of donor files that have a setuid or setgid bits.

3. Call mntwantwrite() and mntdropwrite() before and after ext4moveextents() calling to get write access to a mount.

Signed-off-by: Akira Fujita <a-fujita.nec.com> Signed-off-by: "Theodore Ts'o" <tytso> --- fs/ext4/ioctl.c | 30 ++++++++++++++++++------------ fs/ext4/moveextent.c | 7 +++++++ 2 files changed, 25 insertions(+), 12 deletions(-)

diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c index 31e5ee0..b63d193 100644 --- a/fs/ext4/ioctl.c +++ b/fs/ext4/ioctl.c @@ -221,32 +221,38 @@ setversionout: struct file donorfilp; int err; + if (!(filp->fmode & FMODEREAD) || + !(filp->fmode & FMODEWRITE)) + return -EBADF; + if (copyfromuser(&me, (struct moveextent user )arg, sizeof(me))) return -EFAULT; + me.movedlen = 0; donorfilp = fget(me.donorfd); if (!donorfilp) return -EBADF; - if (!capable(CAPDACOVERRIDE)) { - if ((current->realcred->fsuid != inode->iuid) || - !(inode->imode & SIRUSR) || - !(donorfilp->fdentry->dinode->imode & - SIRUSR)) { - fput(donorfilp); - return -EACCES; - } + if (!(donorfilp->fmode & FMODEWRITE)) { + err = -EBADF; + goto mextout; } - me.movedlen = 0; + err = mntwantwrite(filp->fpath.mnt); + if (err) + goto mextout; + err = ext4moveextents(filp, donorfilp, me.origstart, me.donorstart, me.len, &me.movedlen); - fput(donorfilp); + mntdropwrite(filp->fpath.mnt); + if (me.movedlen > 0) + fileremovesuid(donorfilp); if (copytouser((struct moveextent )arg, &me, sizeof(me))) - return -EFAULT; - + err = -EFAULT; +mextout: + fput(donorfilp); return err; } diff --git a/fs/ext4/moveextent.c b/fs/ext4/moveextent.c index cad1e2e..82c415b 100644 --- a/fs/ext4/moveextent.c +++ b/fs/ext4/moveextent.c @@ -957,6 +957,13 @@ mextcheckarguments(struct inode originode, return -EINVAL; } + if (donorinode->imode & (SISUID|SISGID)) { + ext4debug("ext4 move extent: suid or sgid is set" + " to donor file [ino:orig %lu, donor %lu]\n", + originode->iino, donorinode->iino); + return -EINVAL; + } + / Ext4 move extent does not support swapfile / if (ISSWAPFILE(originode) || ISSWAPFILE(donorinode)) { ext4debug("ext4 move extent: The argument files should " -- 1.6.5.216.g5288a.dirty

Race condition in the mac80211 subsystem in the Linux kernel before 2.6.32-rc8-next-20091201 allows remote attackers to cause a denial of service (system crash) via a Delete Block ACK (aka DELBA) packet that triggers a certain state change in the absence of an aggregation session.

The collectrxframe function in drivers/isdn/hisax/hfcusb.c in the Linux kernel before 2.6.32-rc7 allows attackers to have an unspecified impact via a crafted HDLC packet that arrives over ISDN and triggers a buffer under-read.

Lennert Buytenhek noticed that delBA handling in mac80211 was broken and has remotely triggerable problems, some of which are due to some code shuffling I did that ended up changing the order in which things were done -- this was

commit d75636ef9c1af224f1097941879d5a8db7cd04e5 Author: Johannes Berg <johannes> Date: Tue Feb 10 21:25:53 2009 +0100

mac80211: RX aggregation: clean up stop session

and other parts were already present in the original

commit d92684e66091c0f0101819619b315b4bb8b5bcc5 Author: Ron Rindjunsky <ron.rindjunsky> Date: Mon Jan 28 14:07:22 2008 +0200

mac80211: A-MPDU Tx add delBA from recipient support

The first problem is that I moved a BUGON before various checks -- thereby making it possible to hit. As the comment indicates, the BUGON can be removed since the ampduaction callback must already exist when the state is != IDLE.

The second problem isn't easily exploitable but there's a race condition due to unconditionally setting the state to OPERATIONAL when a delBA frame is received, even when no aggregation session was ever initiated. All the drivers accept stopping the session even then, but that opens a race window where crashes could happen before the driver accepts it. Right now, a WARNON may happen with non-HT drivers, while the race opens only for HT drivers.

For this case, there are two things necessary to fix it: 1) don't process spurious delBA frames, and be more careful about the session state; don't drop the lock

2) HT drivers need to be prepared to handle a session stop even before the session was really started -- this is true for all drivers (that support aggregation) but iwlwifi which can be fixed easily. The other HT drivers (ath9k and ar9170) are behaving properly already.

The pollmodeio file for the megaraidsas driver in the Linux kernel 2.6.31.6 and earlier has world-writable permissions, which allows local users to change the I/O mode of the driver by modifying this file.

Hi,

Description of problem:

execution of a particular program from the Arachne suite reliably causes a kernel panic due to a NULL-pointer dereference in nfs4proclock().

Version-Release number of selected component (if applicable):

2.6.18-164.2.1.el5

How reproducible:

always on NFSv4 mounted directories

Steps to Reproduce: 1. wget http://www.genoscope.cns.fr/externe/redhat/XMLMissingField 2. Save a copy on an NFSv4-mounted directory 3. Execute it Actual results:

Kernel panic

Expected results:

No panic

Additional info:

Console output:

Unable to handle kernel NULL pointer dereference at 0000000000000030 RIP: [<ffffffff8837b210>] :nfs:nfs4proclock+0x21f/0x3ad PGD 1026eec067 PUD 1026f2f067 PMD 0 Oops: 0000 [1] SMP last sysfs file: /block/dm-1/range CPU 0 Modules linked in: ipmidevintf ipmisi ipmimsghandler nfs lockd fscache nfsacl sunrpc bonding ipv6 xfrmnalgo cryptoapi video hwmon backlight sbs i2cec button battery asusacpi acpimemhotplug ac joydev sg shpchp i2cnforce2 i2ccore forcedeth dmsnapshot dmzero dmmod satanv libata mptsas mptscsih mptbase scsitransportsas sdmod scsimod ext3 jbd uhcihcd ohcihcd ehcihcd Pid: 4070, comm: XMLMissingField Not tainted 2.6.18-164.2.1.el5 #1 RIP: 0010:[<ffffffff8837b210>] [<ffffffff8837b210>] :nfs:nfs4proclock+0x21f/0x3ad RSP: 0018:ffff810819bdbdd8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff810827c52088 RSI: 0000000000000006 RDI: ffff810819bdbe38 RBP: ffff81081a6dfdc0 R08: 0000000000000001 R09: ffff810819bdbd68 R10: ffff810819bdbd68 R11: 00000000000000d0 R12: ffff810827c52088 R13: 0000000000000000 R14: ffff810819a9b930 R15: 0000000000000006 FS: 00002b97d31fc7b0(0000) GS:ffffffff803c1000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000030 CR3: 00000010268cb000 CR4: 00000000000006e0 Process XMLMissingField (pid: 4070, threadinfo ffff810819bda000, task ffff810827d6a7e0) Stack: 00000000000003e8 0000000000000000 ffff810819a9b930 ffffffff88373e4f 0000000000000000 0000000000000000 0000000000000000 0000000019a9ba40 ffff810819bdbe18 ffff810819bdbe18 0000000000000000 0000000000000000 Call Trace: [<ffffffff88373e4f>] :nfs:nfssyncinodewait+0x116/0x1db [<ffffffff8836a226>] :nfs:dosetlk+0x55/0x8c [<ffffffff80039e72>] fcntlsetlk+0x11e/0x273 [<ffffffff800b66fa>] auditsyscallentry+0x180/0x1b3 [<ffffffff8002e5bb>] sysfcntl+0x269/0x2dc [<ffffffff8005d28d>] tracesys+0xd5/0xe0

Code: 49 8b 45 30 4c 89 e6 4c 89 ef 45 8a 74 24 58 48 8b 40 18 48 RIP [<ffffffff8837b210>] :nfs:nfs4proclock+0x21f/0x3ad RSP <ffff810819bdbdd8> CR2: 0000000000000030 <0>Kernel panic - not syncing: Fatal exception

Also see http://www.spinics.net/linux/lists/linux-nfs/msg03357.html

Quote from the upstream commit: Debug registers may only be accessed from cpl 0. Unfortunately, vmx will code to emulate the instruction even though it was issued from guest userspace, possibly leading to an unexpected trap later.

Introduced in v2.6.30-rc1; Fixed in v2.6.32-rc1.

http://git.kernel.org/linus/0a79b009525b160081d75cef5dbf45817956acf2

Quoting from upstream patch: On setting up the callback to the client, we attempt to use the same authentication flavor the client did. We find an rpc cred to use by calling rpcauthlookupcredcache(), which assumes that the given authentication flavor has a credentials cache. However, this is not required to be true--in particular, authnull does not use one. Instead, we should call the auth's lookupcred() method.

Without this, a client attempting to mount using nfsv4 and authnull triggers a null dereference.

The code was introduced in upstream commit 3cef9ab2 (v2.6.31-rc1), fixed in 886e3b7f (v2.6.32-rc1), and was later replaced by 80fc015b.

Integer overflow in the kvmdevioctlgetsupportedcpuid function in arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel before 2.6.31.4 allows local users to have an unspecified impact via a KVMGETSUPPORTEDCPUID request to the kvmarchdevioctl function.

Quoting from the upstream commit: Almost all r128's private ioctls require that the CCE state has already been initialised. However, most do not test that this has been done, and will proceed to dereference a null pointer. This may result in a security vulnerability, since some ioctls are unprivileged.

This adds a macro for the common initialisation test and changes all ioctl implementations that require prior initialisation to use that macro.

Also, r128doinitcce() does not test that the CCE state has not been initialised already. Repeated initialisation may lead to a crash or resource leak. This adds that test.

http://git.kernel.org/linus/7dc482dfeeeefcfd000d4271c4626937406756d7

Other references: http://secunia.com/advisories/36707/

Description of problem: (description copied from bug 515857).

The hardware condition is the same as bz504732 described: 2 machines and a switch supporting jumbo frames(actually we didn't use a switch but a coaxial-cable). The pingee has a rtl8169 NIC.

I configure MTU of both machine, the pinger is set to 9000 and the pingee is set to 7200.

Then I execute flood ping from the pinger to pingee by execute ping -f -s 3000 <pingee's IP>, few seconds later the pingee crashed.

Crash doesn't occur when using ping -f <pingee's IP> (i.e. don't send large packets).

Version-Release number of selected component (if applicable):

rhel-5.4 with kernel-2.6.18-160.el5

How reproducible:

as described above.

Actual results:

few seconds after executing ping -f -s 3000, the pingee gives out the error message, then crashes:

PCI-DMA: Out of IOMMU space for 7222 bytes at device 0000:03:00.0 PCI-DMA: Out of IOMMU space for 7222 bytes at device 0000:03:00.0 <Repeated Many Many Times> PCI-DMA: Out of IOMMU space for 7222 bytes at device 0000:03:00.0 PCI-DMA: Out of IOMMU space for 7222 bytes at device 0000:03:00.0

HARDWARE ERROR CPU 0: Machine Check Exception: 7 Bank 4: bc0000000005001b RIP 10:<ffffffff8006b2b0> {defaultidle+0x29/0x50} TSC 10116da2355 ADDR 4000000 MISC c008000001000000 This is not a software problem! Run through mcelog --ascii to decode and contact your hardware vendor Kernel panic - not syncing: Uncorrected machine check <7>APIC error on CPU2: 00(08)

the pinger prints dots on screen(since no reply received) repeatedly.

Expected results:

the pingee doesn't crash, or the pingee refuses the flood ping(since flood ping usually used as a kind of DoS attack).

Additional info:

The getrandomint function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value, and possibly defeat protection mechanisms based on randomization, via vectors that leverage the function's tendency to "return the same value over and over again for long stretches of time."

cfg80211 in net/wireless/scan.c in the Linux kernel 2.6.30-rc1 and other versions before 2.6.31-rc6 allows remote attackers to cause a denial of service (crash) via a sequence of beacon frames in which one frame omits an SSID Information Element (IE) and the subsequent frame contains an SSID IE, which triggers a NULL pointer dereference in the cmpies function. NOTE: a potential weakness in the ismesh function was also addressed, but the relevant condition did not exist in the code, so it is not a vulnerability.

The eisaeepromread function in the parisc isa-eeprom component (drivers/parisc/eisaeeprom.c) in the Linux kernel before 2.6.31-rc6 allows local users to access restricted memory via a negative ppos argument, which bypasses a check that assumes that ppos is positive and causes an out-of-bounds read in the readb function.

Description of problem: Dan Walsh's blog post mentioned in the previous comment details selinux-policy part of the issue tracked via bug #512284. As noted in the the blog, selinux-policy provides a boolean - allowunconfinedmmaplow - which controls whether mmapminaddr restriction is applied to the process. This boolean, however, did not work as expected, as unconfinedt domain (default domain for logged-in unprivileged users) was always permitted to map low memory pages regardless of the boolean setting. This problem with the boolean is being fixed and the fix will be included in future selinux-policy updates in RHEL5 and Fedora (see Dan's blog for NVRs).

Few notes specific to Red Hat Enterprise Linux 5: Support for mmapminaddr sysctl was not included in the GA version of RHEL5. It was only added in kernel update in 5.2 (it first appeared upstream in 2.6.24). selinux-policy was, to avoid breaking applications needing low memory pages mapping on upgrade from 5.1 to 5.2, configured to allow mmapzero in unconfined domains and only disallow it in confined domains (e.g. various network facing services). In 5.3, allowunconfinedmmaplow boolean was added, but it's default value for targeted policy was changed to on, i.e. allowing mmapzero in all unconfined domains by default. This default boolean value is planned to remain unchanged in 5.4.

It should also be noted, that even with allowunconfinedmmaplow boolean set to off, it is still possible for unconfinedt user to transition to other domain that is permitted to mmapzero, as details in the Dan's blog post. Upstream discussion on how to best address this issue is still ongoing.

Eric's proposed patches moving mmapminaddr check out of security were submitted. If they are accepted upstream, mmapminaddr will be checked before LSM hooks are called. Security modules will only be consulted if mmapminaddr check has passed (e.g. when mmapminaddr is 0), so SELinux may still be able to restrict mapping of the low pages / zero page for confined domains and permit mapping in unconfined, even when mmapminaddr is 0.

Eric's patches with further discussion: http://patchwork.kernel.org/patch/36540/ http://patchwork.kernel.org/patch/36539/

Updated version: http://patchwork.kernel.org/patch/36650/ http://patchwork.kernel.org/patch/36649/

Further discussion of the proposed change: http://thread.gmane.org/gmane.linux.kernel.lsm/9075

mmapminaddr on SELinux and non-SELinux systems http://eparis.livejournal.com/606.html

Confining the unconfined. Oxymoron? http://danwalsh.livejournal.com/30084.html

Kbase: http://kbase.redhat.com/faq/docs/DOC-18042

Description of problem: Reported by Tavis Ormandy and Julien Tinnes. The SOCKOPSWRAP macro from include/linux/net.h doesn't initialise the sendpage operation in the protoops structure correctly. Leading to a kernel NULL pointer dereference, and thus a local privilege escalation.

Acknowledgements:

Red Hat would like to thank Tavis Ormandy and Julien Tinnes of the Google Security Team for responsibly reporting this flaw.

The initposixtimers function in kernel/posix-timers.c in the Linux kernel before 2.6.31-rc6 allows local users to cause a denial of service (OOPS) or possibly gain privileges via a CLOCKMONOTONICRAW clocknanosleep call that triggers a NULL pointer dereference.

Buffer overflow in fs/cifs/connect.c in CIFS in the Linux kernel 2.6.29 and earlier allows remote attackers to cause a denial of service (crash) via a long nativeFileSystem field in a Tree Connect response to an SMB mount request.