Bug 68421 – Local Kernel DoS (CAN-2004-0814)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Hanno Böck 2004-10-21 10:23:50 UTC]

Alan Cox reported two kernel-bugs in < 2.6.9 (reported as CAN-2004-0814, but that isn't public yet).
It can be used to crash the system as a local user and can cause a lock through ppp.

[Comment 1 Thierry Carrez (RETIRED) 2004-11-09 08:33:49 UTC]

Moving to newly-created kernel-specific category

[Comment 2 Tim Yamin (RETIRED) 2004-11-09 14:31:15 UTC]

Ok, all patched. The following are externally maintained, so I'm CCing the relevant maintainers. Patches are at http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security...

grsec-sources -- Adding solar.
hardened-dev-sources -- Adding Gentoo/Hardened team.
hardened-sources -- Adding scox.
hppa(-dev)-sources -- Adding GMSoft.
mips-sources -- Adding `Kumba.
openmosix-sources -- Adding cluster herd.
rsbac(-dev)-sources -- Adding kang.
selinux-sources -- Adding pebenito.
sparc-sources -- Adding Joker.

[Comment 3 solar (RETIRED) 2004-11-09 23:57:45 UTC]

I get patch failures with these and the places where it fails I'm not sure I'm the best man for editing and ensureing that said code will function correctly. When it comes time for a GLSA. I guess you can mask grsec-sources or something cuz I'm going to wait for 2.4.28 and let this bug resolve itself... Oh hurry up 2.4.28 tree I'm sick of patching 2.4.27...

[Comment 4 Konstantin Arkhipov (RETIRED) 2004-11-10 01:30:14 UTC]

openmosix-sources patched.

[Comment 5 Christian Birchinger (RETIRED) 2004-11-10 09:27:19 UTC]

Fixed in sparc-sources-2.4.27-r2

[Comment 6 Chris PeBenito (RETIRED) 2004-11-10 09:47:55 UTC]

selinux-sources p.mask'ed as it will be removed soon

[Comment 7 solar (RETIRED) 2004-11-11 12:59:57 UTC]

grsec kernel patched as sys-kernel/grsec-sources-2.4.27.2.0.1-r3
Sent the patch to the mirrors as 22860b67a043f4f2d601eab21fb3cfaf  /usr/portage/distfiles/grsec-sources-2.4.27-CAN-2004-0814.patch.bz2

scox: the above patch should work for hardened-sources as well.

[Comment 8 Joshua Kinard 2004-11-19 18:07:11 UTC]

mips-sources updated.

[Comment 9 Jeremy Huddleston (RETIRED) 2004-11-23 13:52:18 UTC]

plasmaroo, your linux-2.6.7-CAN-2004-0814.patch is missing this:
--- linux-2.6.7-1140_CAN-2004-0814/drivers/char/tty_ioctl.c     2004-11-23 13:23:23.000000000 -0800
+++ linux-2.6.7-1140_CAN-2004-0814.fixed/drivers/char/tty_ioctl.c       2004-11-23 13:24:43.123269616 -0800
@@ -293,6 +293,7 @@
        int retval;
        struct sgttyb tmp;
        struct termios termios;
+       unsigned long flags;
 
        retval = tty_check_change(tty);
        if (retval)

[Comment 10 Jeremy Huddleston (RETIRED) 2004-11-23 13:53:03 UTC]

Created attachment 44603 [details, diff]
1140_CAN-2004-0814.patch-r1 - 2.6.7 patch with added hunk

This applies cleanly against vanilla 2.6.7 and was updated from the 
patch in genpatches-2.6-7.47

[Comment 11 Tim Yamin (RETIRED) 2004-11-23 14:13:37 UTC]

Kumba, you will need to add the updated 2.6.7 patch (on this bug or on my devspace) to the 2.6.7 mips-sources. Thanks for the update, Jeremy.

[Comment 12 Guy Martin (RETIRED) 2004-11-24 09:39:02 UTC]

hppa-(dev-)sources done.

[Comment 13 Sune Kloppenborg Jeppesen (RETIRED) 2004-11-27 07:12:28 UTC]

Kumba please see comment #11

[Comment 14 Jeremy Huddleston (RETIRED) 2004-11-28 04:54:11 UTC]

Created attachment 44858 [details, diff]
ditto for the 2.6.8 patch

I was just messing around with g-d-s-2.6.8, and I noticed the same thing with
your  2.6.8.1 patch...

[Comment 15 Adam Mondl (RETIRED) 2004-11-28 11:50:15 UTC]

hardened-sources-2.4.28 ~arch in tree

[Comment 16 Guillaume Destuynder (RETIRED) 2004-11-28 15:52:39 UTC]

rsba-sources bumped to 2.4.28 (~x86)

[Comment 17 Joshua Kinard 2004-12-01 03:24:28 UTC]

mips-sources fixed.

[Comment 18 Tim Yamin (RETIRED) 2004-12-01 11:49:32 UTC]

GMSoft: 2.6.8.1 needs an updated patch, please see attachment #44858 [details, diff] on this bug.

Hardened herd: Only hardened-dev-sources is left for this bug. Some swift action would be appreciated since this is blocking the GLSA. We may need to mask if this issue is not dealt with quickly. Thanks!

[Comment 19 Adam Mondl (RETIRED) 2004-12-01 13:08:16 UTC]

Fixed in stable hardened-dev-sources-r16

[Comment 20 Guy Martin (RETIRED) 2004-12-08 09:14:35 UTC]

Patch updated for hppa-dev-sources.

[Comment 21 Tim Yamin (RETIRED) 2004-12-20 14:31:09 UTC]

Kang: rsbac-dev-sources still needs fixing on this one...

[Comment 22 Guillaume Destuynder (RETIRED) 2005-01-13 16:00:18 UTC]

rsbac-dev-sources was fixed too

[Comment 23 Tim Yamin (RETIRED) 2005-01-15 14:36:52 UTC]

All kernels fixed, closing bug; notifications are being migrated away from GLSAs for kernels, more news coming soon so stay tuned :-]