Bug 243150 (CVE-2008-3528)

Summary:	Kernel: 2.6.26.5 DOS via printk (CVE-2008-3528)
Product:	Gentoo Security	Reporter:	Stefan Behte (RETIRED) <craig>
Component:	Kernel	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	kernel
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.27.y.git;a=commit;h=382931f3e09030e7e4d7fcaee2ad3cdc1d396a14
Whiteboard:	[linux <2.6.25.20] [linux >=2.6.26 <2.6.26.8] [linux >=2.6.27 <2.6.27.4]
Package list:		Runtime testing required:	---

Description Stefan Behte (RETIRED) gentoo-dev

2008-10-21 22:21:21 UTC

CVE-2008-3528 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3528):
  The error-reporting functionality in (1) fs/ext2/dir.c, (2)
  fs/ext3/dir.c, and possibly (3) fs/ext4/dir.c in the Linux kernel
  2.6.26.5 does not limit the number of printk console messages that
  report directory corruption, which allows physically proximate
  attackers to cause a denial of service (temporary system hang) by
  mounting a filesystem that has corrupted dir->i_size and
  dir->i_blocks values and performing (a) read or (b) write operations.
   NOTE: there are limited scenarios in which this crosses privilege
  boundaries.

Comment 1 Stefan Behte (RETIRED) gentoo-dev

2008-10-21 22:24:49 UTC

Excluding hardened, as they do not have 2.6.26.5.

http://lkml.org/lkml/2008/9/13/98
http://lkml.org/lkml/2008/9/13/99
http://lkml.org/lkml/2008/9/17/371

Upstream commits:
- bd39597cbd42a784105a04010100e27267481c67 (ext2)
- cdbf6dba28e8e6268c8420857696309470009fd9 (ext3)
- 9d9f177572d9e4eba0f2e18523b44f90dd51fe74 (ext4)