New Kernel Crash-Exploit discovered

[Dave Jones]

On Mon, Jun 14, 2004 at 10:06:36AM -0700, Villalovos, John L wrote:
 > Not sure if people have seen this.  I'm assuming that a patch will need
 > to be figured out and done.
 > 
 > Requires local user shell access.
 > 
 > Mentioned on Slashdot today:
 > 
 > http://linuxreviews.org/news/2004-06-11_kernel_crash/index.html

For those interested, here's what I rolled into the FC1 update.
Might even apply to the old RHL tree, but haven't tried.

		Dave

--- linux-2.4.22/include/asm-x86_64/i387.h~	2004-06-14 15:36:18.816344576 +0100
+++ linux-2.4.22/include/asm-x86_64/i387.h	2004-06-14 15:36:36.426667400 +0100
@@ -34,7 +34,7 @@
 
 #define clear_fpu( tsk ) do { \
 	if ( tsk->flags & PF_USEDFPU ) { \
-		asm volatile("fwait"); \
+		asm volatile("fnclex ; fwait"); \
 		tsk->flags &= ~PF_USEDFPU; \
 		stts(); \
 	} \
--- linux-2.4.22/include/asm-i386/i387.h~	2004-06-14 15:36:40.427059248 +0100
+++ linux-2.4.22/include/asm-i386/i387.h	2004-06-14 15:36:53.369091760 +0100
@@ -34,7 +34,7 @@
 
 #define clear_fpu( tsk ) do { \
 	if ( tsk->flags & PF_USEDFPU ) { \
-		asm volatile("fwait"); \
+		asm volatile("fnclex ; fwait"); \
 		tsk->flags &= ~PF_USEDFPU; \
 		stts(); \
 	} \