Bug 158792 – Kernel: settimeofday() let certain local users set the time backwards (CVE-2005-4352)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Daniel Drake (RETIRED) 2006-12-21 19:06:12 UTC]

A local user with securelevel permissions greater than "1" can invoke settimeofday() to cause the clock time to wrap to "Fri Dec 13 20:45:52 UTC 1901" which then allows the user to set any time value. As a result, the local user can move the time backwards.

[Comment 1 Daniel Drake (RETIRED) 2006-12-23 08:03:28 UTC]

Fixed in:
 Linux 2.6.18.3
 genpatches-2.6.18-4
 gentoo-sources-2.6.18-r3

[Comment 2 Harlan Lieberman-Berg (RETIRED) 2006-12-26 20:01:23 UTC]

rsbac-sources: Kang, please bump to 2.6.18.3.
systrace-sources: Lcars, please bump to 2.6.18.3
usermode-sources: Dang, please bump to 2.6.18.3
xen-sources: Someone ( ;) ), please bump to 2.6.18.3

[Comment 3 Daniel Gryniewicz (RETIRED) 2007-01-02 19:59:59 UTC]

usermode-sources-2.6.18-r1 added.

[Comment 4 Guillaume Destuynder (RETIRED) 2007-01-12 13:43:42 UTC]

rsbac-sources-2.6.19 is in cvs (~arch)

[Comment 5 Andrew Ross (RETIRED) 2007-01-27 06:02:22 UTC]

Thanks, this is fixed in xen-sources-2.6.16.28-r2, which will hit the tree in a few hours (just waiting for the mirrors to update before I commit the ebuild).

[Comment 6 Harlan Lieberman-Berg (RETIRED) 2007-01-30 01:28:41 UTC]

All fixed.