Bug 243156 (CVE-2008-4554)

Summary:	Kernel: do_splice_from() arbitrary changes with O_APPEND (CVE-2008-4554)
Product:	Gentoo Security	Reporter:	Stefan Behte (RETIRED) <craig>
Component:	Kernel	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	kernel
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.26.y.git;a=commit;h=efc968d450e013049a662d22727cf132618dcb2f
Whiteboard:	[linux <2.6.25.19] [linux >=2.6.26 <2.6.26.7]
Package list:		Runtime testing required:	---

Description Stefan Behte (RETIRED) gentoo-dev

2008-10-21 22:42:42 UTC

CVE-2008-4554 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4554):
  The do_splice_from function in fs/splice.c in the Linux kernel before
  2.6.27 does not reject file descriptors that have the O_APPEND flag
  set, which allows local users to bypass append mode and make
  arbitrary changes to other locations in the file.

Comment 1 Stefan Behte (RETIRED) gentoo-dev

2008-10-21 22:43:59 UTC

http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27

Comment 2 kfm 2009-07-20 23:55:58 UTC

hardened-kernel unaffected at present time. Removing alias.

PS: genpatches-2.6.26-4 added 2.6.26.7. =genpatches-2.6.25* remains vulnerable. However, hardened-sources-2.6.25-r13 does not because we independently folded in the newer stable patches.