Bug 72452 - Linux Kernel Local DoS and Memory Content Disclosure Vulnerabilities (CAN-2004-1074)
|
Bug#:
72452
|
Product: Gentoo Security
|
Version: unspecified
|
Platform: All
|
|
OS/Version: Linux
|
Status: RESOLVED
|
Severity: normal
|
Priority: P2
|
|
Resolution: FIXED
|
Assigned To: security@gentoo.org
|
Reported By: jg@cms.ac
|
|
Component: Kernel
|
|
|
URL:
http://secunia.com/advisories/13308/
|
|
Summary: Linux Kernel Local DoS and Memory Content Disclosure Vulnerabilities (CAN-2004-1074)
|
|
Keywords:
|
|
Status Whiteboard: [linux <2.6.10]
|
|
Opened: 2004-11-25 05:37 0000
|
source: http://secunia.com/advisories/13308/
Affected: 2.4.x + 2.6.x
Description:
Two vulnerabilities have been reported in the Linux Kernel, which can be exploited by malicious, local users to cause a DoS (Denial of Service) or gain knowledge of potentially sensitive information.
1) An unspecified error can be exploited via a specially crafted a.out binary to cause a DoS.
2) A race condition within the memory management can be exploited to disclose the content of random physical memory pages.
Original Advisory:
http://www.suse.de/de/security/2004_01_sr.html
Reproducible: Always
Steps to Reproduce:
Ok, do we have a patch for issue #2 or has SuSE finally released their kernel
updates...?
All done, the following externally maintained sources need maintainer magic:
grsec-sources - Solar, I think you've fixed this? Confirm please.
gentoo-dev-sources - Adding dsd...
hardened(-dev)-sources - Adding hardened herd...
hppa(-dev)-sources - Adding GMSoft...
mips-sources - Adding Kumba...
openmosix-sources - Adding cluster herd...
pegasos-dev-sources - Adding dholm...
rsbac(-dev)-sources - Adding kang...
sparc-sources - Adding Joker...
sparc-sources-2.4.28-r1 released
grsec-sources-2.4.28 has not had any additional security patches added to it
yet.
uptime is only 5 days and not looking forward to patching kernel again.
debating dropping grsec-sources all together.
Well I went to patch grsec sources this morn but I see that somebody has
totally fsked it up. That would be you dsd. Please fix what you broke.
Fixed in ~arch hardened-sources-2.4.28
pegasos-dev-sources fixed
oM-sources: fixed in ~x86.
~x86 hardened-dev-sources fixed
Done on hppa(-dev)-sources.
|- rsbac-dev-sources: done in r10
|- rsbac-sources: done in r1
All kernels appear to be done at this point.. Removing extra CC: people
~x86 hardened-sources-2.4.28-r1 updated for VMA patch
Ok, all patched - the following externally maintained sources need to make sure
they also have the VMA patches for both 2.4 and 2.6 applied.
*NOTE* If you already have done this (for both branches if applicable), please
state so on this bug. Thanks!
grsec-sources -- Adding tocharian...
hppa(-dev)-sources -- Adding GMSoft...
mips-sources -- Adding `Kumba...
openmosix-sources -- Adding cluster herd...
pegasos-dev-sources -- Adding dholm...
rsbac(-dev)-sources -- Adding kang...
sparc-sources -- Adding Joker...
Fixed sparc-sources-2.4.28-r3 released.
pegasos-dev-sources should be fixed
grsec-sources-2.4.28.2.0.2-r3 has updated VMA patch
2.4 is dropped on hppa and I've added 2.6.10-pa1 which doesn't seems affected
by this problem.
rsbac-sources: all fixed/updated (old -dev also, so)
All kernels fixed, closing bug; notifications are being migrated away from
GLSAs for kernels, more news coming soon so stay tuned :-]
A little heads-up :
Committed to 2.6 :
http://linux.bkbits.net:8080/linux-2.6/cset@41a6721cce-LoPqkzKXudYby_3TUmg
"This is the issue covered by CAN-2004-1074 where a improperly formed binary can cause an oops. Since this got fixed separately for 64 bit binaries and a number of distros (like RedHat) will have fixed one but not the other it deserves it's own CVE name (split due to version), CAN-2005-0003."
I don't understand everything :) Please doublecheck we're OK :)
