Bug 158792

Summary:	Kernel: settimeofday() let certain local users set the time backwards (CVE-2005-4352)
Product:	Gentoo Security	Reporter:	Daniel Drake (RETIRED) <dsd>
Component:	Kernel	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	kang, lcars
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.18.y.git;a=commit;h=c721af6db5992d16fbd93855666eafa616512e00
Whiteboard:	[linux <2.6.16.33] [linux >=2.6.17 <2.6.18.3]
Package list:		Runtime testing required:	---

Description Daniel Drake (RETIRED) gentoo-dev

2006-12-21 19:06:12 UTC

A local user with securelevel permissions greater than "1" can invoke settimeofday() to cause the clock time to wrap to "Fri Dec 13 20:45:52 UTC 1901" which then allows the user to set any time value. As a result, the local user can move the time backwards.

Comment 1 Daniel Drake (RETIRED) gentoo-dev

2006-12-23 08:03:28 UTC

Fixed in:
 Linux 2.6.18.3
 genpatches-2.6.18-4
 gentoo-sources-2.6.18-r3

Comment 2 Harlan Lieberman-Berg (RETIRED) gentoo-dev

2006-12-26 20:01:23 UTC

rsbac-sources: Kang, please bump to 2.6.18.3.
systrace-sources: Lcars, please bump to 2.6.18.3
usermode-sources: Dang, please bump to 2.6.18.3
xen-sources: Someone ( ;) ), please bump to 2.6.18.3

Comment 3 Daniel Gryniewicz (RETIRED) gentoo-dev

2007-01-02 19:59:59 UTC

usermode-sources-2.6.18-r1 added.

Comment 4 Guillaume Destuynder (RETIRED) gentoo-dev

2007-01-12 13:43:42 UTC

rsbac-sources-2.6.19 is in cvs (~arch)

Comment 5 Andrew Ross (RETIRED) gentoo-dev

2007-01-27 06:02:22 UTC

Thanks, this is fixed in xen-sources-2.6.16.28-r2, which will hit the tree in a few hours (just waiting for the mirrors to update before I commit the ebuild).

Comment 6 Harlan Lieberman-Berg (RETIRED) gentoo-dev

2007-01-30 01:28:41 UTC

All fixed.