Register | Forget Password | Login
Search :
SecurityReason

News

Search

SecurityAlert

About SecurityAlert

ExploitAlert

SecurityReason Research

WLB

WLB Database

Send to WLB

About WLB

RSS

News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Corporate

Contact

About us

Services

SecurePHP

Note

If you have found a vulnerability, please send to our SecurityAlert Database :
secalert()securityreason()com

Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive :
exploit()securityreason()com

Details : SecurityAlert

  Topic : Move utrace into task_struct
  SecurityAlert : 3965
  CVE : CVE-2008-2365
  CWE : CWE-362
  SecurityRisk : Low  alert  (About)
  Remote Exploit : No
  Local Exploit : Yes
  Victim interaction required : No
  Exploit Given : No
  Credit : Alexey Dobriyan
  Published : 02.07.2008

  Affected Software : Red Hat, Desktop, 4.0
Red Hat, Enterprise Linux AS, 4.0
Red Hat, Enterprise Linux ES, 4.0
Red Hat, Enterprise Linux WS, 4.0
Linux, Kernel, 2.6.10
Linux, Kernel, 2.6.10 Rc2
Linux, Kernel, 2.6.11
Linux, Kernel, 2.6.11 Rc2
Linux, Kernel, 2.6.11 Rc3
Linux, Kernel, 2.6.11 Rc4
Linux, Kernel, 2.6.11.11
Linux, Kernel, 2.6.11.12
Linux, Kernel, 2.6.11.4
Linux, Kernel, 2.6.11.5
Linux, Kernel, 2.6.11.6
Linux, Kernel, 2.6.11.7
Linux, Kernel, 2.6.11.8
Linux, Kernel, 2.6.12
Linux, Kernel, 2.6.12 Rc1
Linux, Kernel, 2.6.12 Rc4
Linux, Kernel, 2.6.12 Rc5
Linux, Kernel, 2.6.12.1
Linux, Kernel, 2.6.12.12
Linux, Kernel, 2.6.12.2
Linux, Kernel, 2.6.12.22
Linux, Kernel, 2.6.12.3
Linux, Kernel, 2.6.12.4
Linux, Kernel, 2.6.12.5
Linux, Kernel, 2.6.12.6
Linux, Kernel, 2.6.13
Linux, Kernel, 2.6.13 Rc1
Linux, Kernel, 2.6.13 Rc4
Linux, Kernel, 2.6.13 Rc6
Linux, Kernel, 2.6.13 Rc7
Linux, Kernel, 2.6.13.1
Linux, Kernel, 2.6.13.2
Linux, Kernel, 2.6.13.3
Linux, Kernel, 2.6.13.4
Linux, Kernel, 2.6.14
Linux, Kernel, 2.6.14 Rc1
Linux, Kernel, 2.6.14 Rc2
Linux, Kernel, 2.6.14 Rc3
Linux, Kernel, 2.6.14 Rc4
Linux, Kernel, 2.6.14.1
Linux, Kernel, 2.6.14.2
Linux, Kernel, 2.6.14.3
Linux, Kernel, 2.6.14.4
Linux, Kernel, 2.6.14.5
Linux, Kernel, 2.6.15
Linux, Kernel, 2.6.15 Rc1
Linux, Kernel, 2.6.15 Rc2
Linux, Kernel, 2.6.15 Rc3
Linux, Kernel, 2.6.15.1
Linux, Kernel, 2.6.15.11
Linux, Kernel, 2.6.15.2
Linux, Kernel, 2.6.15.3
Linux, Kernel, 2.6.15.4
Linux, Kernel, 2.6.16
Linux, Kernel, 2.6.16 Rc1
Linux, Kernel, 2.6.16.1
Linux, Kernel, 2.6.16.11
Linux, Kernel, 2.6.16.12
Linux, Kernel, 2.6.16.13
Linux, Kernel, 2.6.16.19
Linux, Kernel, 2.6.16.23
Linux, Kernel, 2.6.16.27
Linux, Kernel, 2.6.16.7
Linux, Kernel, 2.6.16.9
Linux, Kernel, 2.6.17
Linux, Kernel, 2.6.17 Rc5
Linux, Kernel, 2.6.17.1
Linux, Kernel, 2.6.17.10
Linux, Kernel, 2.6.17.11
Linux, Kernel, 2.6.17.12
Linux, Kernel, 2.6.17.13
Linux, Kernel, 2.6.17.14
Linux, Kernel, 2.6.17.2
Linux, Kernel, 2.6.17.3
Linux, Kernel, 2.6.17.5
Linux, Kernel, 2.6.17.6
Linux, Kernel, 2.6.17.7
Linux, Kernel, 2.6.17.8
Linux, Kernel, 2.6.18
Linux, Kernel, 2.6.18.1
Linux, Kernel, 2.6.18.3
Linux, Kernel, 2.6.18.4
Linux, Kernel, 2.6.19
Linux, Kernel, 2.6.19 Rc1
Linux, Kernel, 2.6.19 Rc2
Linux, Kernel, 2.6.19 Rc3
Linux, Kernel, 2.6.19 Rc4
Linux, Kernel, 2.6.19.1
Linux, Kernel, 2.6.19.2
Linux, Kernel, 2.6.20
Linux, Kernel, 2.6.20.1
Linux, Kernel, 2.6.20.11
Linux, Kernel, 2.6.20.13
Linux, Kernel, 2.6.20.15
Linux, Kernel, 2.6.20.2
Linux, Kernel, 2.6.20.3
Linux, Kernel, 2.6.20.4
Linux, Kernel, 2.6.20.5
Linux, Kernel, 2.6.20.8
Linux, Kernel, 2.6.20.9
Linux, Kernel, 2.6.21
Linux, Kernel, 2.6.21.1
Linux, Kernel, 2.6.21.2
Linux, Kernel, 2.6.21.4
Linux, Kernel, 2.6.21.6
Linux, Kernel, 2.6.21.7
Linux, Kernel, 2.6.21_rc3
Linux, Kernel, 2.6.21_rc4
Linux, Kernel, 2.6.21_rc5
Linux, Kernel, 2.6.21_rc6
Linux, Kernel, 2.6.22
Linux, Kernel, 2.6.22.1
Linux, Kernel, 2.6.22.11
Linux, Kernel, 2.6.22.12
Linux, Kernel, 2.6.22.13
Linux, Kernel, 2.6.22.14
Linux, Kernel, 2.6.22.15
Linux, Kernel, 2.6.22.16
Linux, Kernel, 2.6.22.17
Linux, Kernel, 2.6.22.3
Linux, Kernel, 2.6.22.4
Linux, Kernel, 2.6.22.5
Linux, Kernel, 2.6.22.6
Linux, Kernel, 2.6.22.7
Linux, Kernel, 2.6.22.8
Linux, Kernel, 2.6.23
Linux, Kernel, 2.6.23 Rc1
Linux, Kernel, 2.6.23.09
Linux, Kernel, 2.6.23.1
Linux, Kernel, 2.6.23.10
Linux, Kernel, 2.6.23.14
Linux, Kernel, 2.6.23.2
Linux, Kernel, 2.6.23.3
Linux, Kernel, 2.6.23.4
Linux, Kernel, 2.6.23.5
Linux, Kernel, 2.6.23.6
Linux, Kernel, 2.6.23.7
Linux, Kernel, 2.6.24
Linux, Kernel, 2.6.24 Rc2
Linux, Kernel, 2.6.24.1
Linux, Kernel, 2.6.24.2
Linux, Kernel, 2.6.24.6
Linux, Kernel, 2.6.25
Linux, Kernel, 2.6.25.1
Linux, Kernel, 2.6.25.2
Linux, Kernel, 2.6.25.3
Linux, Kernel, 2.6.25.4
Linux, Kernel, 2.6.9
Linux, Kernel, 2.6.23_rc1
Linux, Kernel, 2.6.24_rc3
Linux, Kernel, 2.6.24_rc4
Linux, Kernel, 2.6.24_rc5
Linux, Kernel, 2.6.25.5



  Advisory Text :  


Regardless of future of "struct utrace utrace;" patch looks like there
is another race: engine's flags and ops settings in utrace_detach() and
acting on them in report_quiescent():

utrace_detach() report_quiescent()
--------------- ------------------
[utrace lock held] [utrace lock is not held]

engine->flags = UTRACE_EVENT(QUIESCE) |
UTRACE_ACTION_QUIESCE;
if (engine->flags & UTRACE_EVENT(QUIESCE))
REPORT(report_quiesce);

rcu_assign_pointer(engine->ops, &dead_engine_ops);


At the moment of REPORT call engine's ops are still "live" ptrace ops
which do not have ->report_quiesce callback. So, there will oops while
calling function at NULL address. "Dead" ptrace engine ops do have dummy
callback but it wasn't yet glued.

I hit this once with "struct utrace utrace;" patch applied, but this
bug is also present in stock utrace, I'm sure.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/



  References :

http://www.openwall.com/lists/oss-security/2008/06/26/1
http://rhn.redhat.com/errata/RHSA-2008-0508.html
https://bugzilla.redhat.com/show_bug.cgi?id=449359
http://www.securityfocus.com/bid/29945
http://sources.redhat.com/cgi-bin/cvsweb.cgi/~checkout~/tests/ptrace-tests/
tests/late-ptrace-may-attach-check.c?cvsroot=systemtap

http://marc.info/?l=linux-kernel&m=117863520707703&w=2
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git;a=commi
t;h=f5b40e363ad6041a96e3da32281d8faa191597b9

http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git;a=commi
t;h=f358166a9405e4f1d8e50d8f415c26d95505b6de

http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git;a=commi
t;h=5ecfbae093f0c37311e89b29bfc0c9d586eace87




  Feedback :

If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
Alert

*BSD libc (strfmon) Multiple vulnerabilities

high- 2008-03-25

Maksymilian Arciemowicz discovered a Integer Overflow vulnerability in the libc library "strfmon()" function.A vulnerability could allow an attacker who successfully exploits this vulnerability to take control of the affected *BSD systems.

Apache rss

» Apache Tomcat <=
   6.0.18 UTF8 Directory
   Traversal Vulnerability

» Apache Tomcat information
   disclosure vulnerability

» Apache Tomcat XSS
   vulnerability

» Apache-SSL memory
   disclosure

PHP rss

» PHP 5.2.6 chdir(),ftok()
   (standard ext) safe_mode
   bypass

» PHP 5.2.6 posix_access()
   (posix ext) safe_mode
   bypass

» PHP 5.2.5 and prior :
   *printf() functions
   Integer Overflow

» PHP 5.2.5 cURL safe_mode
   bypass

Copyright © SecurityReason. All Rights Reserved.