Bug 68421 - Local Kernel DoS (CAN-2004-0814)
Bug#: 68421 Product:  Gentoo Security Version: unspecified Platform: All
OS/Version: All Status: RESOLVED Severity: normal Priority: P2
Resolution: FIXED Assigned To: security@gentoo.org Reported By: hanno@gentoo.org
Component: Kernel
URL:  http://www.securityfocus.com/archive/1/379005/2004-10-18/2004-10-24/0
Summary: Local Kernel DoS (CAN-2004-0814)
Keywords:  
Status Whiteboard: [linux <2.4.28] [linux >=2.6 <2.6.9]
Opened: 2004-10-21 10:23 0000
Description:   Opened: 2004-10-21 10:23 0000 
Alan Cox reported two kernel-bugs in < 2.6.9 (reported as CAN-2004-0814, but
that isn't public yet).
It can be used to crash the system as a local user and can cause a lock through
ppp.

------- Comment #1 From Thierry Carrez (RETIRED) 2004-11-09 08:33:49 0000 ------- 
Moving to newly-created kernel-specific category

------- Comment #2 From Tim Yamin (RETIRED) 2004-11-09 14:31:15 0000 ------- 
Ok, all patched. The following are externally maintained, so I'm CCing the
relevant maintainers. Patches are at
http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security...

grsec-sources -- Adding solar.
hardened-dev-sources -- Adding Gentoo/Hardened team.
hardened-sources -- Adding scox.
hppa(-dev)-sources -- Adding GMSoft.
mips-sources -- Adding `Kumba.
openmosix-sources -- Adding cluster herd.
rsbac(-dev)-sources -- Adding kang.
selinux-sources -- Adding pebenito.
sparc-sources -- Adding Joker.

------- Comment #3 From solar 2004-11-09 23:57:45 0000 ------- 
I get patch failures with these and the places where it fails I'm not sure I'm
the best man for editing and ensureing that said code will function correctly.
When it comes time for a GLSA. I guess you can mask grsec-sources or something
cuz I'm going to wait for 2.4.28 and let this bug resolve itself... Oh hurry up
2.4.28 tree I'm sick of patching 2.4.27...

------- Comment #4 From Konstantin Arkhipov 2004-11-10 01:30:14 0000 ------- 
openmosix-sources patched.

------- Comment #5 From Christian Birchinger 2004-11-10 09:27:19 0000 ------- 
Fixed in sparc-sources-2.4.27-r2

------- Comment #6 From Chris PeBenito 2004-11-10 09:47:55 0000 ------- 
selinux-sources p.mask'ed as it will be removed soon

------- Comment #7 From solar 2004-11-11 12:59:57 0000 ------- 
grsec kernel patched as sys-kernel/grsec-sources-2.4.27.2.0.1-r3
Sent the patch to the mirrors as 22860b67a043f4f2d601eab21fb3cfaf  /usr/portage/distfiles/grsec-sources-2.4.27-CAN-2004-0814.patch.bz2

scox: the above patch should work for hardened-sources as well.

------- Comment #8 From Joshua Kinard 2004-11-19 18:07:11 0000 ------- 
mips-sources updated.

------- Comment #9 From Jeremy Huddleston (RETIRED) 2004-11-23 13:52:18 0000 ------- 
plasmaroo, your linux-2.6.7-CAN-2004-0814.patch is missing this:
--- linux-2.6.7-1140_CAN-2004-0814/drivers/char/tty_ioctl.c     2004-11-23 13:23:23.000000000 -0800
+++ linux-2.6.7-1140_CAN-2004-0814.fixed/drivers/char/tty_ioctl.c       2004-11-23 13:24:43.123269616 -0800
@@ -293,6 +293,7 @@
        int retval;
        struct sgttyb tmp;
        struct termios termios;
+       unsigned long flags;
 
        retval = tty_check_change(tty);
        if (retval)

------- Comment #10 From Jeremy Huddleston (RETIRED) 2004-11-23 13:53:03 0000 ------- 
Created an attachment (id=44603) [details]
1140_CAN-2004-0814.patch-r1 - 2.6.7 patch with added hunk

This applies cleanly against vanilla 2.6.7 and was updated from the 
patch in genpatches-2.6-7.47

------- Comment #11 From Tim Yamin (RETIRED) 2004-11-23 14:13:37 0000 ------- 
Kumba, you will need to add the updated 2.6.7 patch (on this bug or on my
devspace) to the 2.6.7 mips-sources. Thanks for the update, Jeremy.

------- Comment #12 From Guy Martin 2004-11-24 09:39:02 0000 ------- 
hppa-(dev-)sources done.

------- Comment #13 From Sune Kloppenborg Jeppesen 2004-11-27 07:12:28 0000 ------- 
Kumba please see comment #11

------- Comment #14 From Jeremy Huddleston (RETIRED) 2004-11-28 04:54:11 0000 ------- 
Created an attachment (id=44858) [details]
ditto for the 2.6.8 patch

I was just messing around with g-d-s-2.6.8, and I noticed the same thing with
your  2.6.8.1 patch...

------- Comment #15 From Adam Mondl (RETIRED) 2004-11-28 11:50:15 0000 ------- 
hardened-sources-2.4.28 ~arch in tree

------- Comment #16 From Guillaume Destuynder (RETIRED) 2004-11-28 15:52:39 0000 ------- 
rsba-sources bumped to 2.4.28 (~x86)

------- Comment #17 From Joshua Kinard 2004-12-01 03:24:28 0000 ------- 
mips-sources fixed.

------- Comment #18 From Tim Yamin (RETIRED) 2004-12-01 11:49:32 0000 ------- 
GMSoft: 2.6.8.1 needs an updated patch, please see attachment #44858 [details] on this
bug.

Hardened herd: Only hardened-dev-sources is left for this bug. Some swift
action would be appreciated since this is blocking the GLSA. We may need to
mask if this issue is not dealt with quickly. Thanks!

------- Comment #19 From Adam Mondl (RETIRED) 2004-12-01 13:08:16 0000 ------- 
Fixed in stable hardened-dev-sources-r16

------- Comment #20 From Guy Martin 2004-12-08 09:14:35 0000 ------- 
Patch updated for hppa-dev-sources.

------- Comment #21 From Tim Yamin (RETIRED) 2004-12-20 14:31:09 0000 ------- 
Kang: rsbac-dev-sources still needs fixing on this one...

------- Comment #22 From Guillaume Destuynder (RETIRED) 2005-01-13 16:00:18 0000 ------- 
rsbac-dev-sources was fixed too

------- Comment #23 From Tim Yamin (RETIRED) 2005-01-15 14:36:52 0000 ------- 
All kernels fixed, closing bug; notifications are being migrated away from
GLSAs for kernels, more news coming soon so stay tuned :-]