Description of problem: knfsd crashes if you are using it to export shmemfs objects and run strict overcommit. In this situation the current->mm based modifier to the overcommit goes through a NULL pointer. We could simply check for NULL and skip the modifier but we've caught other real bugs in the past from mm being NULL here - cases where we did need a valid mm set up (eg the exec bug in 2005). To preserve the checks and get the logic we want shuffle the checking around and add a new helper to the vm security wrappers Also fix a current->mm reference in nommu that should use the passed mm
Upstream commit: nfsd: fix vm overcommit crash http://git.kernel.org/linus/731572d39fcd3498702eda4600db4c43d51e0b26 nfsd: fix vm overcommit crash fix #2 http://git.kernel.org/linus/1b79cd04fab80be61dcd2732e2423aafde9a4c1c
Reference: [PATCH] knfsd: add nfs-export support to tmpfs http://git.kernel.org/linus/91828a405ae454a9503c41a7744f6ff877a80714
Description of problem: procoomscore(task) has a reference to taskstruct, but that is all. If this task was already released before we take tasklistlock - we can't use task->groupleader, it points to nowhere - it is not safe to call badness() even if this task is ->groupleader, hasintersectsmemsallowed() assumes it is safe to iterate over ->threadgroup list. - even worse, badness() can hit ->signal == NULL Add the pidalive() check to ensure unhashprocess() was not called. Also, use "task" instead of task->groupleader. badness() should return the same result for any sub-thread. Currently this is not true, but this should be changed anyway.
Upstream commit: http://git.kernel.org/linus/b95c35e76b29ba812e5dabdd91592e25ec640e93
Description of problem: If the owner of a PI futex dies we fix up the pistate and set pistate->owner to NULL. When a malicious or just sloppy programmed user space application sets the futex value to 0 e.g. by calling pthreadmutexinit(), then the futex can be acquired again. A new waiter manages to enqueue itself on the pistate w/o damage, but on unlock the kernel dereferences pistate->owner and oopses. Prevent this by checking pistate->owner in the unlock path. If pistate->owner is not current we know that user space manipulated the futex value. Ignore the mess and return -EINVAL. This catches the above case and also the case where a task hijacks the futex by setting the tid value and then tries to unlock it.
Upstream commit: http://git.kernel.org/linus/51246bfd189064079c54421507236fd2723b18f3
Note that pi-futex was introduced in: http://git.kernel.org/linus/c87e2837be82df479a6bae9f155c43516d2feebc
Fix inverted logic in skfpioctl(). Non-privileged users should not be able to clear the driver statistics.
diff --git a/drivers/net/skfp/skfddi.c b/drivers/net/skfp/skfddi.c index 607efea..9a00e55 100644 --- a/drivers/net/skfp/skfddi.c +++ b/drivers/net/skfp/skfddi.c @@ -1003,9 +1003,9 @@ static int skfpioctl(struct netdevice dev, struct ifreq rq, int cmd) break; case SKFPCLRSTATS: / Zero out the driver statistics / if (!capable(CAPNETADMIN)) { - memset(&lp->MacStat, 0, sizeof(lp->MacStat)); - } else { status = -EPERM; + } else { + memset(&lp->MacStat, 0, sizeof(lp->MacStat)); } break; default:
From Clement Lecigne: In function sockgetsockopt() located in net/core/sock.c, optval v.val is not correctly initialized and directly returned in userland in case we have SOBSDCOMPAT option set.
This dummy code should trigger the bug:
int main(void) { unsigned char buf[4] = { 0, 0, 0, 0 }; int len; int sock; sock = socket(33, 2, 2); getsockopt(sock, 1, SOBSDCOMPAT, &buf, &len); printf("%x%x%x%x\n", buf[0], buf[1], buf[2], buf[3]); close(sock); }
References: http://lkml.org/lkml/2009/2/11/374 http://lkml.org/lkml/2009/2/12/123 http://patchwork.kernel.org/patch/6816/
From Chris Evans:
It's a relatively minor signal issue where a child can send its parent process an arbitrary signal, even if the parent has a totally separate real and effective user id. This could be a nuisance in the case where long-running root daemons spawn direct child processes owned by untrusted users []. There may even be worse consequences if privileged processes have weak signal handling code for signals not normally triggerable by untrusted users.
The docoredump function in fs/exec.c in Linux kernel 2.4.x and 2.6.x up to 2.6.24-rc3, and possibly other versions, does not change the UID of a core dump file if it exists before a root process creates a core dump in the same location, which might allow local users to obtain sensitive information.
The signal handling in the Linux kernel before 2.6.22, including 2.6.2, when running on PowerPC systems using HTX, allows local users to cause a denial of service via unspecified vectors involving floating point corruption and concurrency, related to clearing of MSR bits.
The random number feature in Linux kernel 2.6 before 2.6.20.13, and 2.6.21.x before 2.6.21.4, (1) does not properly seed pools when there is no entropy, or (2) uses an incorrect cast when extracting entropy, which might cause the random number generator to provide the same values after reboots on systems without an entropy source.
Linux kernel 2.6.x before 2.6.20 allows local users to read unreadable binaries by using the interpreter (PTINTERP) functionality and triggering a core dump, a variant of CVE-2004-1073.
The seqfile handling (ip6flgetn function in ip6flowlabel.c) in Linux kernel 2.6 up to 2.6.18-stable allows local users to cause a denial of service (hang or oops) via unspecified manipulations that trigger an infinite loop while searching for flowlabels.
The blockpreparewrite function in fs/buffer.c for Linux kernel 2.6.x before 2.6.13 does not properly clear buffers during certain error conditions, which allows local users to read portions of files that have been unlinked.
The copyfromuser function in the uaccess code in Linux kernel 2.6 before 2.6.19-rc1, when running on s390, does not properly clear a kernel buffer, which allows local user space programs to read portions of kernel memory by "appending to a file from a bad address," which triggers a fault that prevents the unused memory from being cleared in the kernel buffer.
The strnlenuser function in Linux kernel before 2.6.16 on IBM S/390 can return an incorrect value, which allows local users to cause a denial of service via unknown vectors.
The selinuxptrace logic in hooks.c in SELinux for Linux 2.6.6 allows local users with ptrace permissions to change the tracer SID to an SID of another process.
Linux kernel 2.4.x and 2.6.x up to 2.6.16 allows local users to bypass IPC permissions and modify a readonly attachment of shared memory by using mprotect to give write permission to the attachment. NOTE: some original raw sources combined this issue with CVE-2006-1524, but they are different bugs.
The Linux kernel before 2.6.16.9 and the FreeBSD kernel, when running on AMD64 and other 7th and 8th generation AuthenticAMD processors, only save/restore the FOP, FIP, and FDP x87 registers in FXSAVE/FXRSTOR when an exception is pending, which allows one process to determine portions of the state of floating point instructions of other processes, which can be leveraged to obtain sensitive information such as cryptographic keys. NOTE: this is the documented behavior of AMD64 processors, but it is inconsistent with Intel processors in a security-relevant fashion that was not addressed by the kernels.
Linux kernel 2.6.16-rc2 and earlier, when running on x8664 systems with preemption enabled, allows local users to cause a denial of service (oops) via multiple ptrace tasks that perform single steps, which can cause corruption of the DEBUGSTACK stack during the dodebug function call.
net/ipv4/netfilter/ipconntrackcore.c in Linux kernel 2.4 and 2.6, and possibly net/ipv4/netfilter/nfconntrackl3protoipv4.c in 2.6, does not clear sockaddrin.sinzero before returning IPv4 socket names from the getsockopt function with SOORIGINALDST, which allows local users to obtain portions of potentially sensitive memory.
Linux kernel 2.6 before 2.6.15.5 allows local users to obtain sensitive information via a crafted XFS ftruncate call, which may return stale data.
The Linux Kernel before 2.6.15.5 allows local users to cause a denial of service (NFS client panic) via unknown attack vectors related to the use of ODIRECT (direct I/O).
Linux kernel before 2.6.15.5, when running on Intel processors, allows local users to cause a denial of service ("endless recursive fault") via unknown attack vectors related to a "bad elf entry address."
Linux kernel 2.6.15.1 and earlier, when running on SPARC architectures, allows local users to cause a denial of service (hang) via a "date -s" command, which causes invalid sign extended arguments to be provided to the getcompattimespec function call.
dm-crypt in Linux kernel 2.6.15 and earlier does not clear a structure before it is freed, which leads to a memory disclosure that could allow local users to obtain sensitive information about a cryptographic key.
Buffer overflow in sysctl in the Linux Kernel 2.6 before 2.6.15 allows local users to corrupt user memory and possibly cause a denial of service via a long string, which causes sysctl to write a zero byte outside the buffer. NOTE: since the sysctl is called from a userland program that provides the argument, this might not be a vulnerability, unless a legitimate user-assisted or setuid scenario can be identified.
The securelevels implementation in NetBSD 2.1 and earlier, and Linux 2.6.15 and earlier, allows local users to bypass time setting restrictions and set the clock backwards by setting the clock ahead to the maximum unixtime value (19 Jan 2038), which then wraps around to the minimum value (13 Dec 1901), which can then be set ahead to the desired time, aka "settimeofday() time wrap."
The udpv6getport function in udp.c in Linux 2.6 before 2.6.14-rc5, when running IPv6, allows local users to cause a denial of service (infinite loop and crash).
The NAT code (1) ipnatprototcp.c and (2) ipnatprotoudp.c in Linux kernel 2.6 before 2.6.13 and 2.4 before 2.4.32-rc1 incorrectly declares a variable to be static, which allows remote attackers to cause a denial of service (memory corruption) by causing two packets for the same protocol to be NATed at the same time, which leads to memory corruption.
Exec in Linux kernel 2.6 does not properly clear posix-timers in multi-threaded environments, which results in a resource leak and could allow a large number of multiple local users to cause a denial of service by using more posix-timers than specified by the quota for a single user.
The sysgetthreadarea function in process.c in Linux 2.6 before 2.6.12.4 and 2.6.13 does not clear a data structure before copying it to userspace, which might allow a user process to obtain sensitive information.