Debian Bug report logs - #250468
Roothole in kernel patch

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Arjan van de Ven <arjanv@redhat.com>

To: submit@bugs.debian.org

Subject: Roothole in kernel patch

Date: Sun, 23 May 2004 09:16:51 +0200

Package: kernel
Version: all 2.4/2.6

The debian kernels include a patch to emulate 80486+ instructions on 80386
cpus. However there is a flaw in this patch in that it does direct userspace
access from the kernel on the pointers provided by the userspace program,
bypassing any kernel security checks, including checks on the address being
actually userspace and not kernel space. As a result any user that can
trigger the trap handler can write any value to any address in kernel space.

Message #10 received at 250468@bugs.debian.org (full text, mbox, reply):

From: Herbert Xu <herbert@gondor.apana.org.au>

To: Arjan van de Ven <arjanv@redhat.com>, 250468@bugs.debian.org

Subject: Re: Bug#250468: Roothole in kernel patch

Date: Sun, 23 May 2004 18:29:14 +1000

On Sun, May 23, 2004 at 09:16:51AM +0200, Arjan van de Ven wrote:
> Package: kernel
> Version: all 2.4/2.6
> 
> The debian kernels include a patch to emulate 80486+ instructions on 80386
> cpus. However there is a flaw in this patch in that it does direct userspace
> access from the kernel on the pointers provided by the userspace program,
> bypassing any kernel security checks, including checks on the address being
> actually userspace and not kernel space. As a result any user that can
> trigger the trap handler can write any value to any address in kernel space.

Thanks for notifying us.  Luckily due to our slow release schedules, this
hasn't hit the stable branch yet.  We'll fix it ASAP.
-- 
Visit Openswan at http://www.openswan.org/
Email:  Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Message #15 received at 250468@bugs.debian.org (full text, mbox, reply):

From: Herbert Xu <herbert@gondor.apana.org.au>

To: Arjan van de Ven <arjanv@redhat.com>, 250468@bugs.debian.org

Subject: Re: Bug#250468: Roothole in kernel patch

Date: Sun, 23 May 2004 20:33:09 +1000

On Sun, May 23, 2004 at 06:29:14PM +1000, herbert wrote:
> On Sun, May 23, 2004 at 09:16:51AM +0200, Arjan van de Ven wrote:
> > Package: kernel
> > Version: all 2.4/2.6
> > 
> > The debian kernels include a patch to emulate 80486+ instructions on 80386
> > cpus. However there is a flaw in this patch in that it does direct userspace
> > access from the kernel on the pointers provided by the userspace program,
> > bypassing any kernel security checks, including checks on the address being
> > actually userspace and not kernel space. As a result any user that can
> > trigger the trap handler can write any value to any address in kernel space.
> 
> Thanks for notifying us.  Luckily due to our slow release schedules, this
> hasn't hit the stable branch yet.  We'll fix it ASAP.

I've had a look at it, and indeed there are missing checks on EIP itself
before the instruction is read.

However, it seems that all the data accesses are already protected
by verify_area calls.  So could you please be a bit more specific about
the flaws?

Thanks in advance,
-- 
Visit Openswan at http://www.openswan.org/
Email:  Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Message #20 received at 250468@bugs.debian.org (full text, mbox, reply):

From: Herbert Xu <herbert@gondor.apana.org.au>

To: Arjan van de Ven <arjanv@redhat.com>, 250468@bugs.debian.org

Subject: Re: Bug#250468: Roothole in kernel patch

Date: Mon, 24 May 2004 19:56:59 +1000

On Sun, May 23, 2004 at 08:33:09PM +1000, herbert wrote:
> 
> I've had a look at it, and indeed there are missing checks on EIP itself
> before the instruction is read.
> 
> However, it seems that all the data accesses are already protected
> by verify_area calls.  So could you please be a bit more specific about
> the flaws?

Well I've since read the thread on lkml.  Since the new kernel
maintainence is already onto this, I'll let them handle it.

Thanks,
-- 
Visit Openswan at http://www.openswan.org/
Email:  Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Message #27 received at 250468@bugs.debian.org (full text, mbox, reply):

From: Nathanael Nerode <neroden@fastmail.fm>

To: 250468@bugs.debian.org

Subject: Supposed security hole in kernel patch

Date: Sat, 9 Oct 2004 15:57:27 -0400

It would help a lot if someone could include a pointer to the appropriate 
thread(s) on lkml, or to something else which explained the purported 
security hole.  I can't find a description of it anywhere.  

Message #34 received at 250468-quiet@bugs.debian.org (full text, mbox, reply):

From: browaeys.alban@wanadoo.fr

To: 250468-quiet@bugs.debian.org, neroden@fastmail.fm

Subject: Re: Bug #250468 - Roothole in kernel patch

Date: Sat, 12 Feb 2005 03:42:44 +0100

This is a followup for bug:
http://bugs.debian.org/250468

I believe this is :
http://article.gmane.org/gmane.linux.kernel/205875

the debian discussion was:
http://people.debian.org/~joey/pr/3.1/i386.html
http://groups.google.fr/groups?hl=fr&lr=&th=cfe5962d77a5b4ce&seekm=2Ts4h-4oD-9%40gated-at.bofh.it&frame=off
on the debian thread i guess we have a circular dependency , and
the lkml one also wonder what is in the debian version of the
patch. We have a mail thread dependcy breakage ! Is there a way to
set severity grave on debian mailing list :->


Maybe Arjan van de Ven knows if our patch is broken as he was
part of the lkml discussion. Sorry i have not read it in its
enterity, neither the debian patch.

Cheers
Alban 

- a memory leak is reported to affect the debian mailig lists -
- CAN 666-999-666 -

Message #39 received at 250468-close@bugs.debian.org (full text, mbox, reply):

From: Andres Salomon <dilinger@debian.org>

To: 250468-close@bugs.debian.org

Subject: Bug#250468: fixed in linux-2.6 2.6.12-1

Date: Thu, 21 Jul 2005 13:30:30 -0400

Source: linux-2.6
Source-Version: 2.6.12-1

We believe that the bug you reported is fixed in the latest version of
linux-2.6, which is due to be installed in the Debian FTP archive:

linux-2.6_2.6.12-1.diff.gz
  to pool/main/l/linux-2.6/linux-2.6_2.6.12-1.diff.gz
linux-2.6_2.6.12-1.dsc
  to pool/main/l/linux-2.6/linux-2.6_2.6.12-1.dsc
linux-2.6_2.6.12.orig.tar.gz
  to pool/main/l/linux-2.6/linux-2.6_2.6.12.orig.tar.gz
linux-doc-2.6.12_2.6.12-1_all.deb
  to pool/main/l/linux-2.6/linux-doc-2.6.12_2.6.12-1_all.deb
linux-headers-2.6.12-1-386_2.6.12-1_i386.deb
  to pool/main/l/linux-2.6/linux-headers-2.6.12-1-386_2.6.12-1_i386.deb
linux-headers-2.6.12-1-686-smp_2.6.12-1_i386.deb
  to pool/main/l/linux-2.6/linux-headers-2.6.12-1-686-smp_2.6.12-1_i386.deb
linux-headers-2.6.12-1-686_2.6.12-1_i386.deb
  to pool/main/l/linux-2.6/linux-headers-2.6.12-1-686_2.6.12-1_i386.deb
linux-headers-2.6.12-1-k7-smp_2.6.12-1_i386.deb
  to pool/main/l/linux-2.6/linux-headers-2.6.12-1-k7-smp_2.6.12-1_i386.deb
linux-headers-2.6.12-1-k7_2.6.12-1_i386.deb
  to pool/main/l/linux-2.6/linux-headers-2.6.12-1-k7_2.6.12-1_i386.deb
linux-headers-2.6.12-1_2.6.12-1_i386.deb
  to pool/main/l/linux-2.6/linux-headers-2.6.12-1_2.6.12-1_i386.deb
linux-image-2.6.12-1-386_2.6.12-1_i386.deb
  to pool/main/l/linux-2.6/linux-image-2.6.12-1-386_2.6.12-1_i386.deb
linux-image-2.6.12-1-686-smp_2.6.12-1_i386.deb
  to pool/main/l/linux-2.6/linux-image-2.6.12-1-686-smp_2.6.12-1_i386.deb
linux-image-2.6.12-1-686_2.6.12-1_i386.deb
  to pool/main/l/linux-2.6/linux-image-2.6.12-1-686_2.6.12-1_i386.deb
linux-image-2.6.12-1-k7-smp_2.6.12-1_i386.deb
  to pool/main/l/linux-2.6/linux-image-2.6.12-1-k7-smp_2.6.12-1_i386.deb
linux-image-2.6.12-1-k7_2.6.12-1_i386.deb
  to pool/main/l/linux-2.6/linux-image-2.6.12-1-k7_2.6.12-1_i386.deb
linux-patch-debian-2.6.12_2.6.12-1_all.deb
  to pool/main/l/linux-2.6/linux-patch-debian-2.6.12_2.6.12-1_all.deb
linux-source-2.6.12_2.6.12-1_all.deb
  to pool/main/l/linux-2.6/linux-source-2.6.12_2.6.12-1_all.deb
linux-tree-2.6.12_2.6.12-1_all.deb
  to pool/main/l/linux-2.6/linux-tree-2.6.12_2.6.12-1_all.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 250468@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Andres Salomon <dilinger@debian.org> (supplier of updated linux-2.6 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Wed, 20 Jul 2005 17:16:04 -0400
Source: linux-2.6
Binary: linux-image-2.6.12-1-k7 linux-headers-2.6.12-1-386 linux-headers-2.6.12-1-em64t-p4 linux-headers-2.6.12-1-s390x linux-image-2.6.12-1-itanium-smp linux-image-2.6.12-1-386 linux-headers-2.6.12-1-itanium linux-headers-2.6.12-1-amd64-generic linux-image-2.6.12-1-amd64-k8 linux-tree-2.6.12 linux-image-2.6.12-1-alpha-generic linux-doc-2.6.12 linux-headers-2.6.12-1-mckinley-smp linux-image-2.6.12-1-s390x linux-image-2.6.12-1-sparc64 linux-headers-2.6.12-1-sparc64-smp linux-headers-2.6.12-1-powerpc-smp linux-image-2.6.12-1-mckinley-smp linux-headers-2.6.12-1-k7 linux-image-2.6.12-1-k7-smp linux-headers-2.6.12-1 linux-image-2.6.12-1-alpha-smp linux-image-2.6.12-1-powerpc-smp linux-image-2.6.12-1-em64t-p4-smp linux-image-2.6.12-1-amd64-generic linux-image-2.6.12-1-amd64-k8-smp linux-image-2.6.12-1-mckinley linux-headers-2.6.12-1-em64t-p4-smp linux-headers-2.6.12-1-powerpc linux-image-2.6.12-1-sparc64-smp linux-image-2.6.12-1-powerpc linux-image-2.6.12-1-686-smp linux-headers-2.6.12-1-686 linux-headers-2.6.12-1-itanium-smp linux-headers-2.6.12-1-amd64-k8 linux-headers-2.6.12-1-alpha-smp linux-headers-2.6.12-1-alpha-generic linux-headers-2.6.12-1-sparc64 linux-headers-2.6.12-1-686-smp linux-headers-2.6.12-1-s390 linux-image-2.6.12-1-s390 linux-headers-2.6.12-1-k7-smp linux-image-2.6.12-1-em64t-p4 linux-headers-2.6.12-1-amd64-k8-smp linux-image-2.6.12-1-686 linux-source-2.6.12 linux-headers-2.6.12-1-mckinley linux-patch-debian-2.6.12 linux-image-2.6.12-1-itanium
Architecture: source all i386
Version: 2.6.12-1
Distribution: unstable
Urgency: low
Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org>
Changed-By: Andres Salomon <dilinger@debian.org>
Description: 
 linux-doc-2.6.12 - Linux kernel specific documentation for version 2.6.12
 linux-headers-2.6.12-1 - Common architecture-specific header files for Linux kernel 2.6.12
 linux-headers-2.6.12-1-386 - Architecture-specific header files for Linux kernel 2.6.12 on 386
 linux-headers-2.6.12-1-686 - Architecture-specific header files for Linux kernel 2.6.12 on PPr
 linux-headers-2.6.12-1-686-smp - Architecture-specific header files for Linux kernel 2.6.12 on mul
 linux-headers-2.6.12-1-k7 - Architecture-specific header files for Linux kernel 2.6.12 on AMD
 linux-headers-2.6.12-1-k7-smp - Architecture-specific header files for Linux kernel 2.6.12 on mul
 linux-image-2.6.12-1-386 - Linux kernel 2.6.12 image on 386-class machines
 linux-image-2.6.12-1-686 - Linux kernel 2.6.12 image on PPro/Celeron/PII/PIII/P4 machines
 linux-image-2.6.12-1-686-smp - Linux kernel 2.6.12 image on multi-processor PPro/Celeron/PII/PII
 linux-image-2.6.12-1-k7 - Linux kernel 2.6.12 image on AMD Duron/Athlon/AthlonXP machines
 linux-image-2.6.12-1-k7-smp - Linux kernel 2.6.12 image on multi-processor AMD Duron/Athlon/Ath
 linux-patch-debian-2.6.12 - Debian patches to version 2.6.12 of the Linux kernel
 linux-source-2.6.12 - Linux kernel source for version 2.6.12 with Debian patches
 linux-tree-2.6.12 - Linux kernel source tree for building Debian kernel images
Closes: 250468 260003 318121
Changes: 
 linux-2.6 (2.6.12-1) unstable; urgency=low
 .
   * New upstream release:
     - "git rocks"
     - address space randomization
     - conversion of ide driver code to the device model
     - restored Philips webcam driver
     - new Broadcom bcm5706 gigabit driver
     - new resource limits for the audio community
     - Multipath device mapper
     - Intel HD Audio alsa driver
     - fixes + arch updates..
     - readdition of tg3 driver, as firmware license has been fixed
 .
   * Dropped the following patches:
     - patch-2.6.11.*.patch (merged)
     - powerpc-ppc64-ibmvscsi.patch (Christoph didn't like it, and it failed
       to build anyways) (Sven Luther)
     - doc-post_halloween.patch (unless someone can come up w/ a valid
       reason for carrying around rapidly bitrotting documentation...)
       (Andres Salomon)
     - sparc32-hypersparc-srmmu.patch (dropped until sparc32 is working
       again, and we can figure out whether it's necessary)
     - fix-alpha-ext3-oops.patch (no longer needed, fixed by compiler)
     - x86-i486_emu.patch (buggy and insecure 80486 instruction emulation
       for 80386; we're no longer supporting this) (closes: #250468)
     - amd64-outs.patch (according to
       http://www.ussg.iu.edu/hypermail/linux/kernel/0502.3/1095.html, this
       is unnecessary for us) (Andres Salomon)
     - sparc64-rtc-mostek.patch (merged)
     - sparc64-compat-nanoseconds.patch (merged)
     - sparc64-sunsu-init-2.6.11.patch (merged)
     - sunsab-uart-update-timeout.patch (merged)
     - alpha-read-trylock.patch (different version got merged)
     - powerpc-prep-motorola-irq-fix.patch (merged)
     - drivers-media-video-saa7134-update.patch (merged)
     - drivers-media-video-saa7134-update-2.patch (merged)
     - drivers-media-video-pll-lib.patch (merged)
     - drivers-media-video-pll-lib-2.patch (merged)
     - drivers-media-video-tuner-update-1.patch (merged)
     - drivers-media-video-tuner-update-2.patch (merged)
     - drivers-media-video-v4l-mpeg-support.patch (merged)
     - drivers-media-video-mt352-update.patch (merged)
     - arch-ppc64-hugepage-aio-panic.patch (merged)
     - drivers-input-serio-nmouse.patch (merged)
     - sparc64-sb1500-clock-2.6.patch (merged)
     - docbook-allow-preprocessor-directives-... (merged)
     - docbook-fix-function-parameter-descriptin-in-fbmem.patch (merged)
     - docbook-move-kernel-doc-comment-next-to-function.patch (merged)
     - powerpc-therm-adt746x-new-i2c-fix.patch (merged)
     - powerpc-mv643xx-enet.patch (merged)
     - powerpc-mv643xx-eth-pegasos.patch (merged)
     - powerpc-pmac-agp-sleep.patch (merged)
     - drivers-input-serio-8042-resume.patch (merged)
 .
   * Premiere of the common-source kernel package
     (Jurij Smakov, Andres Salomon)
     - build all architectures out of kernel source package
     - rename source and binary packages
     - create a common config for different architectures, and management
       tools to allow for easier modification of config options
     - drop default configs, autogenerate them instead; requires
       kernel-package >= 9.002.
 .
   * Add 2.6.12.1 (Maximilian Attems)
     - Clean up subthread exec (CAN-2005-1913)
     - ia64 ptrace + sigrestore_context (CAN-2005-1761)
 .
   * Add 2.6.12.2 (Frederik Schüler)
     - Fix two socket hashing bugs.
     -  ACPI: Make sure we call acpi_register_gsi() even for default PCI
        interrupt assignment
     - Add "memory" clobbers to the x86 inline asm of strncmp and friends
     - e1000: fix spinlock bug
     - fix remap_pte_range BUG
     - Fix typo in drivers/pci/pci-driver.c
 .
   * Add 2.6.12.3 (Joshua Kwan)
     - Fix semaphore handling in __unregister_chrdev
     - Fix TT mode in UML.
     - Check for a null return in tty_ldisc_ref.
     - v4l: cx88 hue offset fix
     - Fix 8139cp breakage that occurs with tpm driver.
     - Fix the 6pack driver in SMP environments.
     - Switch to spinlocks in the shaper driver.
     - ppc32: stop misusing NTP's time_offset value
     - netfilter: go back to dropping conntrack references manually
     - ACPI: don't accept 0 as a PCI IRQ.
 .
   * Enable CONFIG_SCSI_INITIO. (Maximilian Attems) (closes: #318121)
 .
   * [powerpc] :
     - Added powerpc-mkvmlinuz-support patch which allows, together with
       kernel-package 9.0002 to add mkvmlinuz support to hand built packages.
     - Removed powerpc-ppc64-ibmvscsi.patch, FTBFS, and Christoph doesn't like
       it and thinks it is not needed.
     - Disabled swim3 on powerpc-smp, FTBFS.
     - Disabled software-suspend on powerpc-smp, FTBFS, amd64/i386 only smp code.
     - Rediffed and readded the G4 L2 hardware flush assist patch from Jacob Pan.
     (Sven Luther)
 .
   * [sparc]
     - Drop sparc32 flavour for now. sparc32 kernel is currently in the
       category "too buggy for us to support". In spite of numerous efforts
       I still see occasional random filesystem corruptions in my tests.
       That does NOT mean that we are dropping sparc32 support, we will
       work with upstream trying to solve these problems for the next
       kernel release. Those interested in helping/testing are encouraged
       to subscribe to debian-sparc mailing list.
       (Jurij Smakov)
 .
   * [alpha]
     - Renamed resulting binary packages for alpha, kernel-image-x.y.z-generic
       wasn't a generic kernel, it was a generic kernel for alpha machines, so
       we're now using linux-image-x.y.z-alpha-generic (and of course, the same
       change for the smp kernel-image). This change was postponed after the
       sarge release. (closes: #260003)
     (Norbert Tretkowski)
 .
   * [amd64]
     - Now using the default compiler (gcc-4.0), thus we get rid of the
       annoying MAKEFLAGS="CC=gcc-3.4" make-kpkg... invocation for third-party
       modules.
       This release lacks 64bit kernels for i386 userland; support will be
       added in a later release as soon as the toolchain has stabilized again.
       (Frederik Schüler)
Files: 
 09f3572ebbdd2b586abc718101a0e7f7 2426 devel optional linux-2.6_2.6.12-1.dsc
 31e32aed4ef702ccf06151b630e7f438 45940419 devel optional linux-2.6_2.6.12.orig.tar.gz
 5ec08f4b3c78e4a1bac78c6b9cedc36b 201357 devel optional linux-2.6_2.6.12-1.diff.gz
 eada7c04c1cb3aba2f0f8093dad3331d 36531032 devel optional linux-source-2.6.12_2.6.12-1_all.deb
 8f28344a2345b2b7a28bc2ca8eeb9682 5034 devel optional linux-tree-2.6.12_2.6.12-1_all.deb
 370fbdec63e2582615d2404e418fcaa7 108040 devel optional linux-patch-debian-2.6.12_2.6.12-1_all.deb
 f0c2e9d31addcdc4d38859e707fff30d 4414572 doc optional linux-doc-2.6.12_2.6.12-1_all.deb
 a1b9a9d12cb8e5272f3c8292a29cd733 2878810 devel optional linux-headers-2.6.12-1_2.6.12-1_i386.deb
 66c22d03691554bea9d008e8d008ead1 743140 devel optional linux-headers-2.6.12-1-386_2.6.12-1_i386.deb
 650febf6f28780ea736379ad32790477 14584254 base optional linux-image-2.6.12-1-386_2.6.12-1_i386.deb
 9c1b9a2462611de63eb7d21af8f93db2 741214 devel optional linux-headers-2.6.12-1-686_2.6.12-1_i386.deb
 f1de92c7e39c237244998161e99789a7 16709786 base optional linux-image-2.6.12-1-686_2.6.12-1_i386.deb
 a91a99d32215041cb0ee8094d65edacd 739974 devel optional linux-headers-2.6.12-1-686-smp_2.6.12-1_i386.deb
 119f582d4b6c45a09fe3aed7821c9ee4 16565542 base optional linux-image-2.6.12-1-686-smp_2.6.12-1_i386.deb
 da5b4ddda83c2f3f500ec9b7f5e29968 741390 devel optional linux-headers-2.6.12-1-k7_2.6.12-1_i386.deb
 6a8054845fc428dc5df2482bc63013eb 16468394 base optional linux-image-2.6.12-1-k7_2.6.12-1_i386.deb
 522668d535def4a3b1a1dd976f34d1b0 739734 devel optional linux-headers-2.6.12-1-k7-smp_2.6.12-1_i386.deb
 f2d4f0227130a4acd7d143e1bdffb9eb 16384696 base optional linux-image-2.6.12-1-k7-smp_2.6.12-1_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)

iD8DBQFC38Bl78o9R9NraMQRAtMOAKCZNaFDO+JM9xPgPfTh8YwLWGNWoACgzNUA
4PNZw3DS+GKywSUBa70GfzY=
=1V+A
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.