The pariscshowstack function in arch/parisc/kernel/traps.c in the Linux kernel before 2.6.28-rc7 on PA-RISC allows local users to cause a denial of service (system crash) via vectors associated with an attempt to unwind a stack that contains userspace addresses.
http://marc.info/?l=linux-netdev&m=122593044330973&w=2
"The following code causes a kernel panic on Linux 2.6.26: http://darkircop.org/unix.c
I haven't investigated the bug so I'm not sure what is causing it, and don't know if it's exploitable. The code passes unix sockets from one process to another using unix sockets. The bug probably has to do with closing file descriptors."
net/atm/svc.c in the ATM subsystem in the Linux kernel 2.6.27.8 and earlier allows local users to cause a denial of service (kernel infinite loop) by making two calls to svclisten for the same socket, and then reading a /proc/net/atm/vc file, related to corruption of the vcc table.
The inotify functionality in Linux kernel 2.6 before 2.6.28-rc5 might allow local users to gain privileges via unknown vectors related to race conditions in inotify watch removal and umount.
Buffer overflow in the lbsprocessbss function in drivers/net/wireless/libertas/scan.c in the libertas subsystem in the Linux kernel before 2.6.27.5 allows remote attackers to have an unknown impact via an "invalid beacon/probe response."
From: Eric Sesterhenn: Fix a stack corruption caused by a corrupted hfs filesystem. If the catalog name length is corrupted the memcpy overwrites the catalog btree structure. Since the field is limited to HFSNAMELEN bytes in the structure and the file format, we throw an error if it is too long.
Buffer overflow in the hfsplusfindcat function in fs/hfsplus/catalog.c in the Linux kernel before 2.6.28-rc1 allows attackers to cause a denial of service (memory corruption or system crash) via an hfsplus filesystem image with an invalid catalog namelength field, related to the hfspluscatbuildkeyuni function.
The Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.27 does not properly handle a protocol violation in which a parameter has an invalid length, which allows attackers to cause a denial of service (panic) via unspecified vectors, related to sctpsfviolationparamlen, sctpsfabortviolation, sctpmakeabortviolation, and incorrect data types in function calls.
sctp in Linux kernel before 2.6.25.18 allows remote attackers to cause a denial of service (OOPS) via an INIT-ACK that states the peer does not support AUTH, which causes the sctpprocessinit function to clean up active transports and triggers the OOPS when the T1-Init timer expires.
The sctpauthepsethmacs function in net/sctp/auth.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.26.4, when the SCTP-AUTH extension is enabled, does not verify that the identifier index is within the bounds established by SCTPAUTHHMACIDMAX, which allows local users to obtain sensitive information via a crafted SCTPHMACIDENT IOCTL request involving the sctpgetsockopt function, a different vulnerability than CVE-2008-4113.
Description of problem: Miklos Szeredi reported that splice() to files opened with OAPPEND are ignored, which allows users to bypass the append-only restriction.
Race condition in the dosetlk function in fs/nfs/file.c in the Linux kernel before 2.6.26 allows local users to cause a denial of service (crash) via vectors resulting in an interrupted RPC call that leads to a stray FLPOSIX lock, related to improper handling of a race between fcntl and close in the EINTR case.
The sctpgetsockopthmacident function in net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.26.4, when the SCTP-AUTH extension is enabled, relies on an untrusted length value to limit copying of data from kernel memory, which allows local users to obtain sensitive information via a crafted SCTPHMACIDENT IOCTL request involving the sctpgetsockopt function.
Buffer overflow in nfsd in the Linux kernel before 2.6.26.4, when NFSv4 is enabled, allows remote attackers to have an unknown impact via vectors related to decoding an NFSv4 acl.
A certain Fedora patch for the utrace subsystem in the Linux kernel before 2.6.26.5-28 on Fedora 8, and before 2.6.26.5-45 on Fedora 9, allows local users to cause a denial of service (NULL pointer dereference and system crash or hang) via a call to the utracecontrol function.
Description of problem: Originally from Mark Fasheh <mark.fasheh>
genericfilesplicewrite() does not remove SISUID or SISGID. This is inconsistent with the way we generally write to files.
Proposed upstream patch: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8c34e2d63231d4bf4852bac8521883944d770fe3
Description of problem: Eugene Teo reported that an integer overflow flaw was found in the Linux kernel dccpsetsockoptchange() function. The vulnerability exists due to a lack of sanitisation performed on a user-controlled integer value before the value is employed as the size argument of a memory allocation operation. An attacker may leverage this vulnerability to trigger a kernel panic on a victim's machine remotely.
The bdxioctlpriv function in the tehuti driver (tehuti.c) in Linux kernel 2.6.x before 2.6.25.1 does not properly check certain information related to register size, which has unspecified impact and local attack vectors, probably related to reading or writing kernel memory.
arch/s390/kernel/ptrace.c in Linux kernel 2.6.9, and other versions before 2.6.27-rc6, on s390 platforms allows local users to cause a denial of service (kernel panic) via the user-area-padding test from the ptrace testsuite in 31-bit mode, which triggers an invalid dereference.
The ext4decodeerror function in fs/ext4/super.c in the ext4 filesystem in the Linux kernel before 2.6.32 allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference), and possibly have unspecified other impact, via a crafted read-only filesystem that lacks a journal.
Description of problem: ext4: avoid divide by zero when trying to mount a corrupted file system If sloggroupsperflex is greater than 31, then groupsperflex will overflow and cause a divide by zero error. This can cause kernel BUG if such a file system is mounted. Upstream commit: http://git.kernel.org/linus/503358ae01b70ce6909d19dd01287093f6b6271c
References: http://bugzilla.kernel.org/showbug.cgi?id=14287 http://secunia.com/advisories/37658
Description of problem: Name: CVE-2009-4306 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4306 Final-Decision: Interim-Decision: Modified: Proposed: Assigned: 20091212 Category: Reference: MISC:http://grsecurity.org/test/grsecurity-2.1.14-2.6.32-200912112157.patch Reference: MISC:http://twitter.com/fotisl/statuses/6568947714 Reference: MISC:http://twitter.com/spendergrsec/statuses/6551797457 Reference: MISC:http://twitter.com/spendergrsec/statuses/6567167692 Reference: MISC:http://twitter.com/spendergrsec/statuses/6569596339 Reference: MISC:http://twitter.com/spendergrsec/statuses/6572069107 Reference: MISC:http://twitter.com/spendergrsec/statuses/6583954567 Reference: MISC:http://twitter.com/tytso/statuses/6571730411
Unspecified vulnerability in the EXT4IOCMOVEEXT (aka move extents) ioctl implementation in the ext4 filesystem in the Linux kernel 2.6.32-git6 and earlier allows local users to cause a denial of service (filesystem corruption) via unknown vectors, a different vulnerability than CVE-2009-4131.
Description of problem: From 910123ba363623f15ffb5d05dd87bdf06d08c609 Mon Sep 17 00:00:00 2001 From: Akira Fujita <a-fujita.nec.com> Date: Sun, 6 Dec 2009 23:38:31 -0500 Subject: [PATCH] ext4: Fix insufficient checks in EXT4IOCMOVEEXT
This patch fixes three problems in the handling of the EXT4IOCMOVEEXT ioctl:
1. In current EXT4IOCMOVEEXT, there are read access mode checks for original and donor files, but they allow the illegal write access to donor file, since donor file is overwritten by original file data. To fix this problem, change access mode checks of original (r->r/w) and donor (r->w) files.
2. Disallow the use of donor files that have a setuid or setgid bits.
3. Call mntwantwrite() and mntdropwrite() before and after ext4moveextents() calling to get write access to a mount.
Signed-off-by: Akira Fujita <a-fujita.nec.com> Signed-off-by: "Theodore Ts'o" <tytso> --- fs/ext4/ioctl.c | 30 ++++++++++++++++++------------ fs/ext4/moveextent.c | 7 +++++++ 2 files changed, 25 insertions(+), 12 deletions(-)
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c index 31e5ee0..b63d193 100644 --- a/fs/ext4/ioctl.c +++ b/fs/ext4/ioctl.c @@ -221,32 +221,38 @@ setversionout: struct file donorfilp; int err; + if (!(filp->fmode & FMODEREAD) || + !(filp->fmode & FMODEWRITE)) + return -EBADF; + if (copyfromuser(&me, (struct moveextent user )arg, sizeof(me))) return -EFAULT; + me.movedlen = 0; donorfilp = fget(me.donorfd); if (!donorfilp) return -EBADF; - if (!capable(CAPDACOVERRIDE)) { - if ((current->realcred->fsuid != inode->iuid) || - !(inode->imode & SIRUSR) || - !(donorfilp->fdentry->dinode->imode & - SIRUSR)) { - fput(donorfilp); - return -EACCES; - } + if (!(donorfilp->fmode & FMODEWRITE)) { + err = -EBADF; + goto mextout; } - me.movedlen = 0; + err = mntwantwrite(filp->fpath.mnt); + if (err) + goto mextout; + err = ext4moveextents(filp, donorfilp, me.origstart, me.donorstart, me.len, &me.movedlen); - fput(donorfilp); + mntdropwrite(filp->fpath.mnt); + if (me.movedlen > 0) + fileremovesuid(donorfilp); if (copytouser((struct moveextent )arg, &me, sizeof(me))) - return -EFAULT; - + err = -EFAULT; +mextout: + fput(donorfilp); return err; } diff --git a/fs/ext4/moveextent.c b/fs/ext4/moveextent.c index cad1e2e..82c415b 100644 --- a/fs/ext4/moveextent.c +++ b/fs/ext4/moveextent.c @@ -957,6 +957,13 @@ mextcheckarguments(struct inode originode, return -EINVAL; } + if (donorinode->imode & (SISUID|SISGID)) { + ext4debug("ext4 move extent: suid or sgid is set" + " to donor file [ino:orig %lu, donor %lu]\n", + originode->iino, donorinode->iino); + return -EINVAL; + } + / Ext4 move extent does not support swapfile / if (ISSWAPFILE(originode) || ISSWAPFILE(donorinode)) { ext4debug("ext4 move extent: The argument files should " -- 1.6.5.216.g5288a.dirty
Description of problem: Jay Fenlason reported that anyone who can open any of the /dev/fw files on recent version of the new firewire stack can crash machines with ohci 1.0 controllers (or ohci 1.1 controllers that are being used in ohci 1.0 mode because of hardware bugs) by issuing certain ioctls. This causes a null pointer reference in {fw-,}ohci.c.
On machines with non-blacklisted ohci1.1 controllers, the call does nothing, which is a bug, but doesn't crash.
On Red Hat Enterprise Linux 5, the firewire modules are blacklisted by default, and if they are enabled, the default ownership of the /dev/fw nodes is root:root.
https://patchwork.kernel.org/patch/66747/
Race condition in the mac80211 subsystem in the Linux kernel before 2.6.32-rc8-next-20091201 allows remote attackers to cause a denial of service (system crash) via a Delete Block ACK (aka DELBA) packet that triggers a certain state change in the absence of an aggregation session.
The collectrxframe function in drivers/isdn/hisax/hfcusb.c in the Linux kernel before 2.6.32-rc7 allows attackers to have an unspecified impact via a crafted HDLC packet that arrives over ISDN and triggers a buffer under-read.
Description of problem: fusedirectio() has a loop where requests are allocated in each iteration. if allocation fails, the loop is broken out and follows into an unconditional fuseputrequest() on that invalid pointer."
Upstream commit: http://git.kernel.org/linus/f60311d5f7670d9539b424e4ed8b5c0872fc9e83
This can be triggered when the system is low on memory, and when the fuserequestalloc() function called from fusegetreq() fails. The fuseputrequest() function will then dereference the invalid pointer returned, resulting in a kernel oops.
This was introduced in 413ef8cb (v2.6.14-rc1) and fixed in v2.6.32-rc7.
Lennert Buytenhek noticed that delBA handling in mac80211 was broken and has remotely triggerable problems, some of which are due to some code shuffling I did that ended up changing the order in which things were done -- this was
commit d75636ef9c1af224f1097941879d5a8db7cd04e5 Author: Johannes Berg <johannes> Date: Tue Feb 10 21:25:53 2009 +0100
mac80211: RX aggregation: clean up stop session
and other parts were already present in the original
commit d92684e66091c0f0101819619b315b4bb8b5bcc5 Author: Ron Rindjunsky <ron.rindjunsky> Date: Mon Jan 28 14:07:22 2008 +0200
mac80211: A-MPDU Tx add delBA from recipient support
The first problem is that I moved a BUGON before various checks -- thereby making it possible to hit. As the comment indicates, the BUGON can be removed since the ampduaction callback must already exist when the state is != IDLE.
The second problem isn't easily exploitable but there's a race condition due to unconditionally setting the state to OPERATIONAL when a delBA frame is received, even when no aggregation session was ever initiated. All the drivers accept stopping the session even then, but that opens a race window where crashes could happen before the driver accepts it. Right now, a WARNON may happen with non-HT drivers, while the race opens only for HT drivers.
For this case, there are two things necessary to fix it: 1) don't process spurious delBA frames, and be more careful about the session state; don't drop the lock
2) HT drivers need to be prepared to handle a session stop even before the session was really started -- this is true for all drivers (that support aggregation) but iwlwifi which can be fixed easily. The other HT drivers (ath9k and ar9170) are behaving properly already.
The pollmodeio file for the megaraidsas driver in the Linux kernel 2.6.31.6 and earlier has world-writable permissions, which allows local users to change the I/O mode of the driver by modifying this file.
Description of problem: The megaraidsas driver exposes a number of driver attributes in sysfs. Many of these are read-only, just export information from the driver and are world-readable.
A couple of attributes are writable and may be used to change the behaviour of the driver (e.g. setting debug logging levels, selecting poll vs. interrupt I/O mode etc).
Some of these writable attributes are mistakenly created with world-writable permissions, e.g. dbglvl and pollmodeio:
rw-rw-rw- root root /sys/bus/pci/drivers/megaraidsas/dbglvl rw-rw-rw- root root /sys/bus/pci/drivers/megaraidsas/pollmodeio
$ grep 'DRIVERATTR.SIWUGO' drivers/scsi/megaraid/megaraidsas.c static DRIVERATTR(dbglvl, SIRUGO|SIWUGO, megasassysfsshowdbglvl, static DRIVERATTR(pollmodeio, SIRUGO|SIWUGO,
This would allow an unprivileged user to affect kernel driver behaviour and logging level.
Version-Release number of selected component (if applicable): 2.6.18-.el5
How reproducible: 100%
Steps to Reproduce: (On a system with megaraidsas loaded) 1. ls -l /sys/bus/pci/drivers/megaraidsas/dbglvl 2. ls -l /sys/bus/pci/drivers/megaraidsas/pollmodeio
Actual results: rw-rw-rw- root root /sys/bus/pci/drivers/megaraidsas/dbglvl rw-rw-rw- root root /sys/bus/pci/drivers/megaraidsas/pollmodeio
Expected results: rw------- root root /sys/bus/pci/drivers/megaraidsas/dbglvl rw------- root root /sys/bus/pci/drivers/megaraidsas/pollmodeio
Additional info:
Upstream made the dbdlvl permissions more restrictive:
commit 66dca9b8c50b5e59d3bea8b21cee5c6dae6c9c46 Author: Joe Malicki <jmalicki> Date: Thu Aug 14 17:14:48 2008 -0400
[SCSI] megaraidsas: remove sysfs dbglvl world writeable permissions /sys/bus/pci/drivers/megaraidsas/dbglvl defaults to being world-writable, which seems bad (letting any user affect kernel driver behavior and logging level). This turns off group and user write permissions, so that on typical production systems only root can write to it. [jejb: fix up rejections] Signed-off-by: Joseph Malicki <jmalicki> Acked-by: "Yang, Bo" <Bo.Yang> Signed-off-by: James Bottomley <James.Bottomley>
The pollmodeio pseudofile still has world-writable permissions upstream.