SecurityReason - Move utrace into task_struct

Register | Forget Password | Login

	SecurityReason
News

Search

SecurityAlert

About SecurityAlert

ExploitAlert

SecurityReason Research

	WLB
WLB Database

Send to WLB

About WLB

	RSS
News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

	Corporate
Contact

About us

	Services
SecurePHP


	Note
If you have found a vulnerability, please send to our SecurityAlert Database : secalert()securityreason()com Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive : exploit()securityreason()com

Details : SecurityAlert

Topic :

Move utrace into task_struct

SecurityAlert : 3965

CVE : CVE-2008-2365

CWE : CWE-362

SecurityRisk : Low alert

alert

(About)

Remote Exploit : No

Local Exploit : Yes

Victim interaction required : No

Exploit Given : No

Credit : Alexey Dobriyan

Published : 02.07.2008

Affected Software :

Red Hat, Desktop, 4.0
Red Hat, Enterprise Linux AS, 4.0
Red Hat, Enterprise Linux ES, 4.0
Red Hat, Enterprise Linux WS, 4.0
Linux, Kernel, 2.6.10
Linux, Kernel, 2.6.10 Rc2
Linux, Kernel, 2.6.11
Linux, Kernel, 2.6.11 Rc2
Linux, Kernel, 2.6.11 Rc3
Linux, Kernel, 2.6.11 Rc4
Linux, Kernel, 2.6.11.11
Linux, Kernel, 2.6.11.12
Linux, Kernel, 2.6.11.4
Linux, Kernel, 2.6.11.5
Linux, Kernel, 2.6.11.6
Linux, Kernel, 2.6.11.7
Linux, Kernel, 2.6.11.8
Linux, Kernel, 2.6.12
Linux, Kernel, 2.6.12 Rc1
Linux, Kernel, 2.6.12 Rc4
Linux, Kernel, 2.6.12 Rc5
Linux, Kernel, 2.6.12.1
Linux, Kernel, 2.6.12.12
Linux, Kernel, 2.6.12.2
Linux, Kernel, 2.6.12.22
Linux, Kernel, 2.6.12.3
Linux, Kernel, 2.6.12.4
Linux, Kernel, 2.6.12.5
Linux, Kernel, 2.6.12.6
Linux, Kernel, 2.6.13
Linux, Kernel, 2.6.13 Rc1
Linux, Kernel, 2.6.13 Rc4
Linux, Kernel, 2.6.13 Rc6
Linux, Kernel, 2.6.13 Rc7
Linux, Kernel, 2.6.13.1
Linux, Kernel, 2.6.13.2
Linux, Kernel, 2.6.13.3
Linux, Kernel, 2.6.13.4
Linux, Kernel, 2.6.14
Linux, Kernel, 2.6.14 Rc1
Linux, Kernel, 2.6.14 Rc2
Linux, Kernel, 2.6.14 Rc3
Linux, Kernel, 2.6.14 Rc4
Linux, Kernel, 2.6.14.1
Linux, Kernel, 2.6.14.2
Linux, Kernel, 2.6.14.3
Linux, Kernel, 2.6.14.4
Linux, Kernel, 2.6.14.5
Linux, Kernel, 2.6.15
Linux, Kernel, 2.6.15 Rc1
Linux, Kernel, 2.6.15 Rc2
Linux, Kernel, 2.6.15 Rc3
Linux, Kernel, 2.6.15.1
Linux, Kernel, 2.6.15.11
Linux, Kernel, 2.6.15.2
Linux, Kernel, 2.6.15.3
Linux, Kernel, 2.6.15.4
Linux, Kernel, 2.6.16
Linux, Kernel, 2.6.16 Rc1
Linux, Kernel, 2.6.16.1
Linux, Kernel, 2.6.16.11
Linux, Kernel, 2.6.16.12
Linux, Kernel, 2.6.16.13
Linux, Kernel, 2.6.16.19
Linux, Kernel, 2.6.16.23
Linux, Kernel, 2.6.16.27
Linux, Kernel, 2.6.16.7
Linux, Kernel, 2.6.16.9
Linux, Kernel, 2.6.17
Linux, Kernel, 2.6.17 Rc5
Linux, Kernel, 2.6.17.1
Linux, Kernel, 2.6.17.10
Linux, Kernel, 2.6.17.11
Linux, Kernel, 2.6.17.12
Linux, Kernel, 2.6.17.13
Linux, Kernel, 2.6.17.14
Linux, Kernel, 2.6.17.2
Linux, Kernel, 2.6.17.3
Linux, Kernel, 2.6.17.5
Linux, Kernel, 2.6.17.6
Linux, Kernel, 2.6.17.7
Linux, Kernel, 2.6.17.8
Linux, Kernel, 2.6.18
Linux, Kernel, 2.6.18.1
Linux, Kernel, 2.6.18.3
Linux, Kernel, 2.6.18.4
Linux, Kernel, 2.6.19
Linux, Kernel, 2.6.19 Rc1
Linux, Kernel, 2.6.19 Rc2
Linux, Kernel, 2.6.19 Rc3
Linux, Kernel, 2.6.19 Rc4
Linux, Kernel, 2.6.19.1
Linux, Kernel, 2.6.19.2
Linux, Kernel, 2.6.20
Linux, Kernel, 2.6.20.1
Linux, Kernel, 2.6.20.11
Linux, Kernel, 2.6.20.13
Linux, Kernel, 2.6.20.15
Linux, Kernel, 2.6.20.2
Linux, Kernel, 2.6.20.3
Linux, Kernel, 2.6.20.4
Linux, Kernel, 2.6.20.5
Linux, Kernel, 2.6.20.8
Linux, Kernel, 2.6.20.9
Linux, Kernel, 2.6.21
Linux, Kernel, 2.6.21.1
Linux, Kernel, 2.6.21.2
Linux, Kernel, 2.6.21.4
Linux, Kernel, 2.6.21.6
Linux, Kernel, 2.6.21.7
Linux, Kernel, 2.6.21_rc3
Linux, Kernel, 2.6.21_rc4
Linux, Kernel, 2.6.21_rc5
Linux, Kernel, 2.6.21_rc6
Linux, Kernel, 2.6.22
Linux, Kernel, 2.6.22.1
Linux, Kernel, 2.6.22.11
Linux, Kernel, 2.6.22.12
Linux, Kernel, 2.6.22.13
Linux, Kernel, 2.6.22.14
Linux, Kernel, 2.6.22.15
Linux, Kernel, 2.6.22.16
Linux, Kernel, 2.6.22.17
Linux, Kernel, 2.6.22.3
Linux, Kernel, 2.6.22.4
Linux, Kernel, 2.6.22.5
Linux, Kernel, 2.6.22.6
Linux, Kernel, 2.6.22.7
Linux, Kernel, 2.6.22.8
Linux, Kernel, 2.6.23
Linux, Kernel, 2.6.23 Rc1
Linux, Kernel, 2.6.23.09
Linux, Kernel, 2.6.23.1
Linux, Kernel, 2.6.23.10
Linux, Kernel, 2.6.23.14
Linux, Kernel, 2.6.23.2
Linux, Kernel, 2.6.23.3
Linux, Kernel, 2.6.23.4
Linux, Kernel, 2.6.23.5
Linux, Kernel, 2.6.23.6
Linux, Kernel, 2.6.23.7
Linux, Kernel, 2.6.24
Linux, Kernel, 2.6.24 Rc2
Linux, Kernel, 2.6.24.1
Linux, Kernel, 2.6.24.2
Linux, Kernel, 2.6.24.6
Linux, Kernel, 2.6.25
Linux, Kernel, 2.6.25.1
Linux, Kernel, 2.6.25.2
Linux, Kernel, 2.6.25.3
Linux, Kernel, 2.6.25.4
Linux, Kernel, 2.6.9
Linux, Kernel, 2.6.23_rc1
Linux, Kernel, 2.6.24_rc3
Linux, Kernel, 2.6.24_rc4
Linux, Kernel, 2.6.24_rc5
Linux, Kernel, 2.6.25.5

Advisory Text :

Regardless of future of "struct utrace utrace;" patch looks like there
is another race: engine's flags and ops settings in utrace_detach() and
acting on them in report_quiescent():

utrace_detach() report_quiescent()
--------------- ------------------
[utrace lock held] [utrace lock is not held]

engine->flags = UTRACE_EVENT(QUIESCE) |
UTRACE_ACTION_QUIESCE;
if (engine->flags & UTRACE_EVENT(QUIESCE))
REPORT(report_quiesce);

rcu_assign_pointer(engine->ops, &dead_engine_ops);

At the moment of REPORT call engine's ops are still "live" ptrace ops
which do not have ->report_quiesce callback. So, there will oops while
calling function at NULL address. "Dead" ptrace engine ops do have dummy
callback but it wasn't yet glued.

I hit this once with "struct utrace utrace;" patch applied, but this
bug is also present in stock utrace, I'm sure.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

References :

http://www.openwall.com/lists/oss-security/2008/06/26/1
http://rhn.redhat.com/errata/RHSA-2008-0508.html
https://bugzilla.redhat.com/show_bug.cgi?id=449359
http://www.securityfocus.com/bid/29945
http://sources.redhat.com/cgi-bin/cvsweb.cgi/~checkout~/tests/ptrace-tests/
tests/late-ptrace-may-attach-check.c?cvsroot=systemtap
http://marc.info/?l=linux-kernel&m=117863520707703&w=2
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git;a=commi
t;h=f5b40e363ad6041a96e3da32281d8faa191597b9
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git;a=commi
t;h=f358166a9405e4f1d8e50d8f415c26d95505b6de
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git;a=commi
t;h=5ecfbae093f0c37311e89b29bfc0c9d586eace87

Feedback :

If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.

	Alert
BSD libc (strfmon) Multiple vulnerabilities - 2008-03-25 Maksymilian Arciemowicz discovered a Integer Overflow vulnerability in the libc library "strfmon()" function.A vulnerability could allow an attacker who successfully exploits this vulnerability to take control of the affected BSD systems.


	Apache
» Apache Tomcat <= 6.0.18 UTF8 Directory Traversal Vulnerability

» Apache Tomcat information disclosure vulnerability

» Apache Tomcat XSS vulnerability

» Apache-SSL memory disclosure



	PHP
» PHP 5.2.6 chdir(),ftok() (standard ext) safe_mode bypass

» PHP 5.2.6 posix_access() (posix ext) safe_mode bypass

» PHP 5.2.5 and prior : *printf() functions Integer Overflow

» PHP 5.2.5 cURL safe_mode bypass

Copyright © SecurityReason. All Rights Reserved.