Bug 104361 – Kernel: 64bit privilege escalation (CAN-2005-2490)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Sune Kloppenborg Jeppesen (RETIRED) 2005-08-31 03:04:38 UTC]

CAN-2005-2490: When we copy 32bit ->msg_control contents to kernel, we    
walk the same userland data twice without sanity checks on the second    
pass.  Moreover, if original looks small enough, we end up copying to    
on-stack array. Moreover, if original looks small enough, we end up    
copying to on-stack array.  With a blocking kmalloc() in between and    
copying from userland all along.  Take two threads, have one do sendmsg()    
and another - to tweak memory under it.  So therefore could lead to    
privilege escalation.

[Comment 1 Sune Kloppenborg Jeppesen (RETIRED) 2005-08-31 03:05:06 UTC]

Created attachment 67332 [details, diff]
can-2005-2490-2.4.patch

[Comment 2 Sune Kloppenborg Jeppesen (RETIRED) 2005-08-31 03:06:03 UTC]

Created attachment 67333 [details, diff]
can-2005-2490-2.6.patch

[Comment 3 Sune Kloppenborg Jeppesen (RETIRED) 2005-09-05 01:44:21 UTC]

Created attachment 67666 [details, diff]
can-2005-2490-fixed-2.4.patch

RH reports: portmap broke on ppc64.  This turned out to be an issue on 64bit
arches running 32bit-compat-mode exes doing sendmsg() syscalls with unaligned
CMSG data areas).

[Comment 4 Sune Kloppenborg Jeppesen (RETIRED) 2005-09-05 01:45:08 UTC]

Created attachment 67667 [details, diff]
can-2005-2490-fixed-2.6.patch

[Comment 5 Sune Kloppenborg Jeppesen (RETIRED) 2005-09-05 10:15:13 UTC]

Created attachment 67688 [details, diff]
can-2005-2490-e-2.4.patch

Updated again.

[Comment 6 Thierry Carrez (RETIRED) 2005-09-14 02:23:36 UTC]

Fixed in 2.6.13.1

[Comment 7 Tim Yamin (RETIRED) 2005-12-24 05:06:50 UTC]

All fixed, closing bug.