369073 – (CVE-2011-1769) <dev-util/systemtap-1.5: Two remote denial of service vulnerabilities (CVE-2011-{1769,1781})

Bug 369073 (CVE-2011-1769) - <dev-util/systemtap-1.5: Two remote denial of service vulnerabilities (CVE-2011-{1769,1781})

Summary: <dev-util/systemtap-1.5: Two remote denial of service vulnerabilities (CVE-20...

Status:	RESOLVED FIXED

Alias:	CVE-2011-1769

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal trivial (vote)
Assignee:	Gentoo Security

URL:	http://sourceware.org/git/?p=systemta...
Whiteboard:	~3 [noglsa]
Keywords:

Depends on:
Blocks:

Reported:	2011-05-28 18:39 UTC by Tim Sammut (RETIRED)
Modified:	2011-05-31 07:10 UTC (History)
CC List:	2 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Tim Sammut (RETIRED) gentoo-dev

2011-05-28 18:39:51 UTC

From the upstream commit at $URL:

CVE-2011-1781, CVE-2011-1769: correct DW_OP_{mod,div} division-by-zero bug

    Probing a process with corrupted DWARF information, it has been
    possible to create a kernel-side divison-by-zero.  This fixes.

    Handle DW_OP_div/mod divide by zero. DW_OP_mod should work unsigned.
    * loc2c.c (translate): Use helper functions div_op and mod_op for
      DW_OP_div and DW_OP_mod operands. Set used_deref = true.
    * translate.cxx (translate_runtime): Emit STAP_MSG_LOC2C_03 define.
    * runtime/loc2c-runtime.h: Define dwarf_div_op and dwarf_mod_op macros.
    * runtime/unwind.c (compute_expr): Check for zero before executing
      DW_OP_mod or DW_OP_div.

This appears fixed in the upstream release 1.5,

Comment 1 Sven Wegener gentoo-dev

2011-05-29 10:51:48 UTC

I commited 1.5 yesterday.

Comment 2 Tim Sammut (RETIRED) gentoo-dev

2011-05-29 17:50:34 UTC

(In reply to comment #1)
> I commited 1.5 yesterday.

Great, thank you, please remove vulnerable packages when you have a moment.

Closing NOGLSA since this is ~arch only.