rpms/kernel/F-10 do_sigaltstack-avoid-copying-stack_t-as-a-structure-to-userspace.patch, NONE, 1.1.2.2 kernel.spec, 1.1206.2.83, 1.1206.2.84
Kyle McMartin
kyle at fedoraproject.org
Wed Aug 19 14:22:02 UTC 2009
- Previous message (by thread): rpms/kernel/F-11 do_sigaltstack-avoid-copying-stack_t-as-a-structure-to-userspace.patch, NONE, 1.1.2.2 kernel.spec, 1.1679.2.13, 1.1679.2.14
- Next message (by thread): rpms/dumbster/devel dumbster.spec, NONE, 1.1 dumbster-1.6.pom, NONE, 1.1 dumbster-SimpleSmtpServer.patch, NONE, 1.1 sources, 1.1, 1.2 .cvsignore, 1.1, 1.2
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
Author: kyle
Update of /cvs/pkgs/rpms/kernel/F-10
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv30672
Modified Files:
Tag: private-fedora-10-2_6_27
kernel.spec
Added Files:
Tag: private-fedora-10-2_6_27
do_sigaltstack-avoid-copying-stack_t-as-a-structure-to-userspace.patch
Log Message:
CVE-2009-2847 fix kernel information leak in sigaltstack
do_sigaltstack-avoid-copying-stack_t-as-a-structure-to-userspace.patch:
signal.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
--- NEW FILE do_sigaltstack-avoid-copying-stack_t-as-a-structure-to-userspace.patch ---
From: Linus Torvalds <torvalds at linux-foundation.org>
Date: Sat, 1 Aug 2009 17:34:56 +0000 (-0700)
Subject: do_sigaltstack: avoid copying 'stack_t' as a structure to user space
X-Git-Tag: v2.6.31-rc6~89
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=0083fc2c50e6c5127c2802ad323adf8143ab7856
do_sigaltstack: avoid copying 'stack_t' as a structure to user space
Ulrich Drepper correctly points out that there is generally padding in
the structure on 64-bit hosts, and that copying the structure from
kernel to user space can leak information from the kernel stack in those
padding bytes.
Avoid the whole issue by just copying the three members one by one
instead, which also means that the function also can avoid the need for
a stack frame. This also happens to match how we copy the new structure
from user space, so it all even makes sense.
[ The obvious solution of adding a memset() generates horrid code, gcc
does really stupid things. ]
Reported-by: Ulrich Drepper <drepper at redhat.com>
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
---
diff --git a/kernel/signal.c b/kernel/signal.c
index ccf1cee..f268372 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -2454,11 +2454,9 @@ do_sigaltstack (const stack_t __user *uss, stack_t __user *uoss, unsigned long s
stack_t oss;
int error;
- if (uoss) {
- oss.ss_sp = (void __user *) current->sas_ss_sp;
- oss.ss_size = current->sas_ss_size;
- oss.ss_flags = sas_ss_flags(sp);
- }
+ oss.ss_sp = (void __user *) current->sas_ss_sp;
+ oss.ss_size = current->sas_ss_size;
+ oss.ss_flags = sas_ss_flags(sp);
if (uss) {
void __user *ss_sp;
@@ -2501,13 +2499,16 @@ do_sigaltstack (const stack_t __user *uss, stack_t __user *uoss, unsigned long s
current->sas_ss_size = ss_size;
}
+ error = 0;
if (uoss) {
error = -EFAULT;
- if (copy_to_user(uoss, &oss, sizeof(oss)))
+ if (!access_ok(VERIFY_WRITE, uoss, sizeof(*uoss)))
goto out;
+ error = __put_user(oss.ss_sp, &uoss->ss_sp) |
+ __put_user(oss.ss_size, &uoss->ss_size) |
+ __put_user(oss.ss_flags, &uoss->ss_flags);
}
- error = 0;
out:
return error;
}
Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-10/kernel.spec,v
retrieving revision 1.1206.2.83
retrieving revision 1.1206.2.84
diff -u -p -r1.1206.2.83 -r1.1206.2.84
--- kernel.spec 19 Aug 2009 02:33:58 -0000 1.1206.2.83
+++ kernel.spec 19 Aug 2009 14:22:02 -0000 1.1206.2.84
@@ -787,6 +787,7 @@ Patch11010: linux-2.6-dev-zero-avoid-oom
Patch12000: linux-2.6-virtio-blk-dont-bounce-highmem-requests.patch
Patch13000: make-mmap_min_addr-suck-less.patch
+Patch13001: do_sigaltstack-avoid-copying-stack_t-as-a-structure-to-userspace.patch
%endif
@@ -1427,6 +1428,8 @@ ApplyPatch linux-2.6-virtio-blk-dont-bou
ApplyPatch make-mmap_min_addr-suck-less.patch
+ApplyPatch do_sigaltstack-avoid-copying-stack_t-as-a-structure-to-userspace.patch
+
# END OF PATCH APPLICATIONS
%endif
@@ -2005,6 +2008,8 @@ fi
* Tue Aug 18 2009 Kyle McMartin <kyle at redhat.com>
- Backport several upstream commits 52dec22e739eec8f3a0154f768a599f5489048bd
to improve mmap_min_addr.
+- CVE-2009-2847: do_sigaltstack: avoid copying 'stack_t' as a structure
+ to user space
* Mon Aug 17 2009 Chuck Ebbert <cebbert at redhat.com> 2.6.27.30-170.2.82
- Backport F-11 patch to fix oopses in USB serial drivers. (#517259)
- Previous message (by thread): rpms/kernel/F-11 do_sigaltstack-avoid-copying-stack_t-as-a-structure-to-userspace.patch, NONE, 1.1.2.2 kernel.spec, 1.1679.2.13, 1.1679.2.14
- Next message (by thread): rpms/dumbster/devel dumbster.spec, NONE, 1.1 dumbster-1.6.pom, NONE, 1.1 dumbster-SimpleSmtpServer.patch, NONE, 1.1 sources, 1.1, 1.2 .cvsignore, 1.1, 1.2
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
More information about the fedora-extras-commits
mailing list