133465 2006-05-16 03:15 0000 Kernel: netfilter do_add_counters race (CVE-2006-0039) 2009-07-29 20:31:20 0000 1 1 1 Unclassified Gentoo Security Kernel unspecified All Linux RESOLVED FIXED http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.16.y.git;a=commit;h=893acf3cd9ad9df7ccb582c009c3759abede330b [linux <2.6.16.17] P2 normal --- 1 jaervosz@gentoo.org security@gentoo.org agriffis@gentoo.org chrb@gentoo.org gimli@gentoo.org johnm@gentoo.org kang@gentoo.org jaervosz@gentoo.org 2006-05-16 03:15:34 0000 Not sure wether we already fixed this one or was unaffected. Filing to be sure: Solar Designer found a race condition in do_add_counters(). The beginning of paddc is supposed to be the same as tmp which was sanity-checked above, but it might not be the same in reality. In case the integer overflow and/or the race condition are triggered, paddc->num_counters might not match the allocation size for paddc. If the check below (t->private->number != paddc->num_counters) nevertheless passes (perhaps this requires the race condition to be triggered), IPT_ENTRY_ITERATE() would read kernel memory beyond the allocation size, potentially leaking sensitive data (e.g., passwords from host system or from another VPS) via counter increments. plasmaroo@gentoo.org 2006-05-19 07:02:08 0000 Dan, please add this patch to genpatches, thanks: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=191698 plasmaroo@gentoo.org 2006-05-19 07:03:03 0000 Patch URL: https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=129163 dsd@gentoo.org 2006-05-21 08:47:53 0000 Fixed in genpatches-2.6.16-10 (gentoo-sources-2.6.16-r8) P.S. The patch you linked to is not the complete fix plasmaroo@gentoo.org 2006-05-26 08:17:36 0000 2.6.16.17 has the full fix along with some more SCTP goodies. plasmaroo@gentoo.org 2006-05-26 08:40:35 0000 Maintainers please bump to genpatches-2.6.16-10 or 2.6.16.18: hardened-sources-2.6: johnm, hardened herd hppa-sources-2.6: GMSoft rsbac-sources-2.6: kang sh-sources-2.6: vapier suspend2-sources-2.6: brix usermode-sources-2.6: dang xbox-sources-2.6: chrb, gimli xen-sources-2.6: chrb, agriffis gmsoft@gentoo.org 2006-05-26 09:05:39 0000 hppa-sources-2.6.16.18-pa11 in the tree. henrik@brixandersen.dk 2006-05-26 13:56:21 0000 Fixed in sys-kernel/suspend2-sources-2.6.16-r7. dang@gentoo.org 2006-05-28 20:11:39 0000 usermode bumped to 2.6.16-r1 plasmaroo@gentoo.org 2006-06-24 11:50:39 0000 All fixed, closing. vapier please bump sh-sources.