List: full-disclosure Subject: [Full-Disclosure] Bug in PaX Linux Kernel 2.6 Patches From: ChrisR- <chris () cr-secure ! net> Date: 2004-05-01 12:06:16 Message-ID: <409392B8.8050908 () cr-secure ! net> http://www.cr-secure.net Found by: borg (ChrisR-) A small bug in PaX was found. What is PaX? ----------------------- PaX is a collection of intrusion prevention patches for the Linux Kernel 2.2, 2.4, and 2.6. This advisory only affects the PaX patches for the 2.6 linux kernel. PaX is located at http://pax.grsecurity.net Impact? ------------------ Denial of service through putting the kernel into an infinite loop when ASLR is enabled. Vulnerable PaX code? ----------------------- (sorry for white space) ==================================================== 'linux/mm/mmap.c' if (start_addr != TASK_UNMAPPED_BASE) { #ifdef CONFIG_PAX_RANDMMAP if (current->flags & PF_PAX_RANDMMAP) start_addr = addr = TASK_UNMAPPED_BASE + mm->delta_mmap; else #endif \ start_addr = addr = TASK_UNMAPPED_BASE; goto full_search; } return -ENOMEM; ==================================================== And the correct code, grab the patch at http://pax.grsecurity.net/pax-linux-2.6.5-200405011700.patch ===================================================== Exploit Code? ----------------------- Im not releasing my exploit code for this just yet. Pherhaps I never will. But its very simple code, simple enough to do in 2 lines. Your not getting anymore proof of concept code from me on any advisories. Fix? ----------------------- PaX team is aware of the problem and has already released a fix for this on the PaX homepage. Thanks and greets: Mattjf, TLharris, Shrike, think, and efnet #cryptography http://www.cr-secure.net chris[@]cr-secure[?]net _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
<PaX Team> We never suggested that people should use 2.6 where there can be hostile local users. Only arches that have don't define HAVE_ARCH_UNMAPPED_AREA will be affected by this bug, alpha/ia64/mips/parisc/sparc/sparc64/x86_64 do define this. As disabling ASLR would be an undesirable solution you are encouraged to upgrade to the latest version.
correction, ia64 and sparc64 are also affected but not yet fixed in the public patch. unless someone speaks up, the fix will go out with the next normal release only (probably a few days off).
I think this was patched in hardened-dev-sources-2.6.5-r5 h-d-s-2.6.7-r0 should be out within the week.
Yes, I confirm it was patched in 2.6.5-r5. This is ready for a GLSA (probably common kernel GLSA with bugs 47881 53804 and 54976).
GLSA 200407-02
