Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1207869
| Path | csiph.com!eternal-september.org!feeder.eternal-september.org!aioe.org!bofh.it!news.nic.it!robomod |
|---|---|
| From | Sven Joachim <svenjoac@gmx.de> |
| Newsgroups | linux.kernel |
| Subject | Re: CVE-2015-1805 and 3.14-longterm? |
| Date | Fri, 14 Aug 2015 21:20:02 +0200 |
| Message-ID | <pXsGe-2Nt-9@gated-at.bofh.it> (permalink) |
| References | <pHI2C-gz-19@gated-at.bofh.it> <pXquK-7Tq-11@gated-at.bofh.it> |
| X-Original-To | Greg KH <greg@kroah.com> |
| User-Agent | Gnus/5.13 (Gnus v5.13) Emacs/24.5.50 (gnu/linux) |
| MIME-Version | 1.0 |
| Content-Type | text/plain |
| X-Provags-ID | V03:K0:7erq0+pHH81rqriV5Hruna72ro96wR87SY9hqK7w9NERyJTI9pP YLE/GOcs/VESigTSnEFtUcDw+ZTyqm697y1PFSFqgtXJa29067nP39L5BE1qbWmOGCo0L0C qLaLQecK0yGDVK0rWb/c7PBBGbeyjeTKwR13rP21Jgj6nOBpxXwoqpAUd+RNs9HaMWefISL HME6n3n0vl2seO98fBlaQ== |
| X-Ui-Out-Filterresults | notjunk:1;V01:K0:uEGs8h4kH4U=:3dk1iWdSBOjSrVQF6wDdHU Z6rIAtqDXVEgdvqnQKZaTt8Yfa1jUDp59Ing9DQMKp39kuFjwAOOc3wZRjMchzFWBAiN7nEyp hMkr0u/riI3i6fg3Dna8raHiJVQ/BRSbAsBI0BVoFDn3c2k4wDfHGqalx9U2rTuPMhPLao7kV m/HDUek4zw6gCZIQ7BD5RDH19YuqCY7vm1euHBLK10O5O2y7tQbfLF18gYWnlTSLyxvgh6Lkf U/rHln6arEhBOLpghVn7oc4jmc6CIA9BinJPNBkNCRLOke9fN/o1xSRJ59FHAo6NaglcOD1Sp DumuWEHO/nT61Y1KTpPDZgnJh+jouI3WaOHGKBT7othqtRTMYi+3qmXnCVvY2b76LuzXX58tZ 21JK8aKAojRFQbv4Y9LxSItOUygKehdxu3AFlxEQ4ycIXQ4MjWs6RJb5ysUULz8Ra0qqyB/aM YC4jI7Vh5isjQWVEtB7AhaTafWzhB8iZ7W6tIXGcc97de54qY75MbHTs/G66GYFF5rB0XO75S RcrZK7Dw7zaynk3AyZA0H4Op4Peei43nZJ8bK3rM3LE+PbItlrQKlYz468uClQ+84vw3qMYVM 5wz6oQN2HWKznhVJ4Wcn46OkG7prjmDRsyk/SwWY0IFU8nXKylplxF3cJLnAd7HNwZcLlZbRp VRLtsXXLETC7mbCV4i7Xoktjj1w4ehagM+sqlHvTN4E+YAqN8F+xoMj/u2HeAoVEOUiT4Jocs /s21oDU43hWmA9Gf678oI99+abKqG9CMJ/F9kA== |
| Sender | robomod@news.nic.it |
| List-ID | <linux-kernel.vger.kernel.org> |
| X-Mailing-List | linux-kernel@vger.kernel.org |
| Approved | robomod@news.nic.it |
| Lines | 47 |
| Organization | linux.* mail to news gateway |
| X-Original-Cc | Dick Snippe <Dick.Snippe@npo.nl>, stable@vger.kernel.org, linux-kernel@vger.kernel.org |
| X-Original-Date | Fri, 14 Aug 2015 21:17:49 +0200 |
| X-Original-Message-ID | <87h9o1brxe.fsf@turtle.gmx.de> |
| X-Original-References | <20150702081934.GA13480@npo.nl> <20150814165533.GB32313@kroah.com> |
| X-Original-Sender | linux-kernel-owner@vger.kernel.org |
| Xref | csiph.com linux.kernel:1207869 |
Show key headers only | View raw
On 2015-08-14 18:55 +0200, Greg KH wrote:
> On Thu, Jul 02, 2015 at 10:19:34AM +0200, Dick Snippe wrote:
>> Hello,
>>
>> I'm sorry to bother you with this, but lwn.net reported a rather serious
>> security issue a couple of weeks ago:
>>
>> http://lwn.net/Articles/646590/
>> https://bugzilla.redhat.com/show_bug.cgi?id=1202855
>> CVE-2015-1805
>> "It was found that the Linux kernel's implementation of vectored pipe
>> read and write functionality did not take into account the I/O vectors
>> that were already processed when retrying after a failed atomic access
>> operation, potentially resulting in memory corruption due to an I/O
>> vector array overrun. A local, unprivileged user could use this flaw to
>> crash the system or, potentially, escalate their privileges on the
>> system."
>>
>> It appears that these upstream fixes haven't made it to 3.14.4[456]:
>>
>> http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f0d1bec9d58d4c038d0ac958c9af82be6eb18045
>> http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=637b58c2887e5e57850865839cc75f59184b23d1
>>
>> I'm just a (very happy!) user of the -longterm kernels, so I don't
>> know how this normally works. But it would appear that this bug still
>> exists in the -longterm kernels.
>
> I think, and I might be wrong here, but because
> 637b58c2887e5e57850865839cc75f59184b23d1 (switch pipe_read() to
> copy_page_to_iter()) is not in the 3.14-stable tree (it showed up in
> 3.15), that f0d1bec9d58d4c038d0ac958c9af82be6eb18045 (new helper:
> copy_page_from_iter()) isn't needed (it showed up in 3.16).
>
> So is this a problem in the 3.14-stable tree?
It seems to have been fixed by 6b17faf3d5fa6a727c40613bdf24d73b2a59df27
(pipe: iovec: Fix memory corruption when retrying atomic copy as
non-atomic) in 3.14.46. That fix is also in 3.10.82.
Cheers,
Sven
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Re: CVE-2015-1805 and 3.14-longterm? Greg KH <greg@kroah.com> - 2015-08-14 19:00 +0200
Re: CVE-2015-1805 and 3.14-longterm? Sven Joachim <svenjoac@gmx.de> - 2015-08-14 21:20 +0200
Re: CVE-2015-1805 and 3.14-longterm? Greg KH <greg@kroah.com> - 2015-08-14 22:10 +0200
csiph-web