Last updated 24 July 2024
arch/x86/kernel/entry64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space.
Last updated 24 July 2024
Last updated 24 July 2024
Integer overflow in the agpgenericinsertmemory function in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 allows local users to gain privileges or cause a denial of service (system crash) via a crafted AGPIOCBIND agpioctl ioctl call.
Last updated 24 July 2024
A malicious user or buggy application can inject code and trigger an infinite loop in inetdiagbcaudit()
Also make sure each instruction is aligned on 4 bytes boundary, to avoid unaligned accesses.
http://thread.gmane.org/gmane.linux.network/197206/focus=197386 http://patchwork.ozlabs.org/patch/100857/
Acknowledgements:
Red Hat would like to thank Dan Rosenberg for reporting this issue.
A signedness issue has been found in nextpidmap() function when the "last" parameter is negative as nextpidmap() just quietly accepted whatever "last" pid that was passed in, which is not all that safe when one of the users is /proc.
Setting fpos to negative value when accessing /proc via readdir()/getdents() resulted in sign extension of this value when map pointer was being constructed.
This later lead to #GP becasue the final pointer was not cannonical (x8664).
map = &pidns->pidmap[(last + 1)/BITSPERPAGE]; ffffffff810ac3b4: 48 63 f6 movslq %esi,%rsi <- sign extension (fpos+-) ffffffff810ac3b7: 81 e2 ff 7f 00 00 and $0x7fff,%edx ffffffff810ac3bd: 48 c1 ee 0f shr $0xf,%rsi ffffffff810ac3c1: 48 c1 e6 04 shl $0x4,%rsi ffffffff810ac3c5: 48 8d 5c 37 08 lea 0x8(%rdi,%rsi,1),%rbx ... if (unlikely(!map->page)) ffffffff810ac3cc: 48 8b 7b 08 mov 0x8(%rbx),%rdi <- #GP
Only x8664 architecture seems to be vulnerable to this particular issue (tested ppc64, s390x, ia64).
Reference: http://groups.google.com/group/fa.linux.kernel/browsethread/thread/93c1088451fd3522/4a28ecb7f755a88d?#4a28ecb7f755a88d
Upstream commit: http://git.kernel.org/linus/c78193e9 http://git.kernel.org/linus/d8bdc59f
Acknowledgements:
Red Hat would like to thank Robert Swiecki for reporting this issue.
kernel/signal.c in the Linux kernel before 2.6.39 allows local users to spoof the uid and pid of a signal sender via a sigqueueinfo system call.
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024