Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 75963 - Local priv elevation in LSM capability module (CAN-2004-1337)
Summary: Local priv elevation in LSM capability module (CAN-2004-1337)
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Kernel (show other bugs)
Hardware: All Linux
: High major (vote)
Assignee: Gentoo Security
URL: http://lkml.org/lkml/2004/12/28/112
Whiteboard: [linux >=2.6 < 2.6.11]
Keywords:
Depends on:
Blocks:
 
Reported: 2004-12-28 16:23 UTC by kfm
Modified: 2009-05-03 14:27 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Patch (linux-2.6-75963.patch,979 bytes, patch)
2005-01-07 12:15 UTC, Tim Yamin (RETIRED) 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description kfm 2004-12-28 16:23:48 UTC 
While browsing recent posts from the LKML I noticed one from Lee Revell (see
this bug's URL field). Here's some more information:

* http://lkml.org/lkml/2004/12/28/116

  Lee's follow-up to his original post.

* http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2004-12/0390.html

  A bugtraq post which details the flaw in more detail.
* http://mithra.immunix.com/pipermail/linux-security-module/2004-December/5769.html

  A post on the linux-security-module list containing a patch that apparently
  fixes the flaw.

Apparently, this is something that was discovered some time ago and a patch was
prepared at that time; accordingly, the bugtraq report looks very similar to a
report that was filed some time ago. The folks on the linux-security-module
list didn't seem overly certain as to whether (a) the flaw was genuine (b) it
came about as a result of the patch not making it in the first time. In any
case, it's been corroborated at least once so I thought I'd pass this on.
Comment 1 Tim Yamin (RETIRED) gentoo-dev 2005-01-07 12:15:08 UTC 
Created attachment 47888 [details, diff]
Patch
Comment 2 Daniel Drake (RETIRED) gentoo-dev 2005-01-09 08:31:49 UTC 
gentoo-dev-sources done
Comment 3 Adam Mondl (RETIRED) gentoo-dev 2005-01-11 20:45:02 UTC 
~x86 hardened-dev-sources-2.6.10 patched
Comment 4 Tim Yamin (RETIRED) gentoo-dev 2005-01-15 14:19:00 UTC 
Following externally maintained-sources need patching:

hppa-sources -- Adding GMSoft...
mips-sources -- Adding `Kumba...
pegasos-sources -- Adding dholm...
rsbac-sources -- Adding kang...
Comment 5 David Holm (RETIRED) gentoo-dev 2005-01-16 05:12:44 UTC 
pegasos-sources fixed
Comment 6 Guy Martin (RETIRED) gentoo-dev 2005-01-16 05:29:15 UTC 
Fixed in hppa-sources
Comment 7 Guillaume Destuynder (RETIRED) gentoo-dev 2005-01-18 14:21:13 UTC 
fixed for rsbac-sources  (2.6.10-r1) (sorry for the delay again; hard isp issues lately:/)
Comment 8 Thierry Carrez (RETIRED) gentoo-dev 2005-03-16 03:16:39 UTC 
Mass-Ccing kern-sec@gentoo.org to make sure Kernel Security guys know about all
of these...
Comment 9 Robert Paskowitz (RETIRED) gentoo-dev 2005-05-17 16:19:10 UTC 
KISS shows this one is all fixed: http://kiss.gentoo.org/dev/viewBug.php?BugID=75963
Comment 10 Tim Yamin (RETIRED) gentoo-dev 2005-05-27 11:38:15 UTC 
All fixed, closing bug.