Bug 132855 - Kernel: fs/locks.c Fix lease_init (CVE-2006-{1859,1860})
Bug#: 132855 Product:  Gentoo Security Version: unspecified Platform: All
OS/Version: Linux Status: RESOLVED Severity: normal Priority: P2
Resolution: FIXED Assigned To: security@gentoo.org Reported By: jaervosz@gentoo.org
Component: Kernel
URL:  http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=75dff55af9a989293e9f9bacf049858f4262bc08
Summary: Kernel: fs/locks.c Fix lease_init (CVE-2006-{1859,1860})
Keywords:  
Status Whiteboard: [linux <2.6.16.16]
Opened: 2006-05-09 21:50 0000
Description:   Opened: 2006-05-09 21:50 0000 
It is insane to be giving lease_init() the task of freeing the lock it is
 supposed to initialise, given that the lock is not guaranteed to be
 allocated on the stack. This causes lockups in fcntl_setlease().
 Problem diagnosed by Daniel Hokka Zakrisson <daniel@hozac.com>

 Also fix a slab leak in __setlease() due to an uninitialised return value.
 Problem diagnosed by Björn Steinbrink.

 Tested-by: Daniel Hokka Zakrisson <daniel@hozac.com>

------- Comment #1 From Sune Kloppenborg Jeppesen 2006-05-09 21:50:56 0000 ------- 
It is insane to be giving lease_init() the task of freeing the lock it is
 supposed to initialise, given that the lock is not guaranteed to be
 allocated on the stack. This causes lockups in fcntl_setlease().
 Problem diagnosed by Daniel Hokka Zakrisson <daniel@hozac.com>

 Also fix a slab leak in __setlease() due to an uninitialised return value.
 Problem diagnosed by Björn Steinbrink.

 Tested-by: Daniel Hokka Zakrisson <daniel@hozac.com>

------- Comment #2 From Sune Kloppenborg Jeppesen 2006-05-11 00:14:45 0000 ------- 
2.6.16.16 released to fix this issue.

------- Comment #3 From Jakub Moc (RETIRED) 2006-05-11 08:10:03 0000 ------- 
*** Bug 133024 has been marked as a duplicate of this bug. ***

------- Comment #4 From Tim Yamin (RETIRED) 2006-05-18 13:54:17 0000 ------- 
Dan, please bump genpatches to .16.16. Thanks.

------- Comment #5 From Daniel Drake 2006-05-21 08:47:29 0000 ------- 
Fixed in genpatches-2.6.16-10 (gentoo-sources-2.6.16-r8)

------- Comment #6 From Tim Yamin (RETIRED) 2006-05-26 08:22:52 0000 ------- 
*** Bug 133863 has been marked as a duplicate of this bug. ***

------- Comment #7 From Tim Yamin (RETIRED) 2006-05-26 08:37:47 0000 ------- 
Maintainers please bump:

hardened-sources-2.6: johnm, hardened herd
hppa-sources-2.6: GMSoft
rsbac-sources-2.6: kang
sh-sources-2.6: vapier
suspend2-sources-2.6: brix
usermode-sources-2.6: dang

------- Comment #8 From Guy Martin 2006-05-26 09:05:15 0000 ------- 
hppa-sources-2.6.16.18-pa11 in the tree.

------- Comment #9 From Henrik Brix Andersen 2006-05-26 13:56:16 0000 ------- 
Fixed in sys-kernel/suspend2-sources-2.6.16-r7.

------- Comment #10 From Daniel Gryniewicz 2006-05-28 20:11:41 0000 ------- 
usermode bumped to 2.6.16-r1

------- Comment #11 From Tim Yamin (RETIRED) 2006-06-24 11:50:42 0000 ------- 
All fixed, closing. vapier please bump sh-sources.