Debian Bug report logs - #541403
linux-image-2.6.26-2-686: Local Privilege Escalation

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Stefano <pietranera@gmail.com>

To: Debian Bugs <submit@bugs.debian.org>

Subject: linux-image-2.6.26-2-686: Local Privilege Escalation

Date: Thu, 13 Aug 2009 17:43:25 -0400

Package: linux-image-2.6.26-2-686
Version: 2.6.26-17
Justification: root security hole
Severity: critical
Tags: security

*** Please type your report below this line ***

Hi,

today a serious bug in the Linux Kernel has been discovered and
disclosed. It affects all 2.4 and 2.6 kernels since 2001 on all
architectures. 

See here for more details:
http://blog.cr0.org/2009/08/linux-null-pointer-dereference-due-to.html

Hopefully this bug has already been patched:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e694958388c50148389b0e9b9e9e8945cf0f1b98

I'm pretty sure that you guys already know that, but it is really urgent
to apply the patch and release an update for the linux-image packages.

Thank you for your fantastic job.

Stefano

-- Package-specific info:
** Version:
Linux version 2.6.26-2-686 (Debian 2.6.26-17) (dannf@debian.org) (gcc
version 4.1.3 20080704 (prerelease) (Debian 4.1.2-25)) #1 SMP Sun Jun 21
04:57:38 UTC 2009

-- System Information:
Debian Release: squeeze/sid
Architecture: i386 (i686)

Kernel: Linux 2.6.26-2-686 (SMP w/1 CPU core)

Versions of packages linux-image-2.6.26-2-686 depends on:
ii  debconf [debconf-2.0]         1.5.27     Debian configuration
management sy
ii  initramfs-tools [linux-initra 0.93.4     tools for generating an
initramfs
ii  module-init-tools             3.9-2      tools for managing Linux
kernel mo

Versions of packages linux-image-2.6.26-2-686 recommends:
ii  libc6-i686                    2.9-23     GNU C Library: Shared
libraries [i

Versions of packages linux-image-2.6.26-2-686 suggests:
ii  grub                          0.97-55    GRand Unified Bootloader
(dummy pa
ii  grub-legacy [grub]            0.97-55    GRand Unified Bootloader
(Legacy v
pn  linux-doc-2.6.26              <none>     (no description available)

-- debconf information excluded

Message #10 received at 541403@bugs.debian.org (full text, mbox, reply):

From: Bertrand Yvain <pnl@ielo.net>

To: Debian Bug Tracking System <541403@bugs.debian.org>

Subject: linux-2.6: patch

Date: Fri, 14 Aug 2009 17:59:29 +0200

Package: linux-2.6
Version: 2.6.18.dfsg.1-24etch2
Followup-For: Bug #541403


Linux 2.6.18 lacks kernel_sendpage, used by official patch.
Here is a substitute.

--- net/socket.c.orig	2009-08-14 16:51:19.000000000 +0200
+++ net/socket.c	2009-08-14 16:52:20.000000000 +0200
@@ -698,7 +698,10 @@
 	if (more)
 		flags |= MSG_MORE;
 
-	return sock->ops->sendpage(sock, page, offset, size, flags);
+	if (sock->ops->sendpage)
+		return sock->ops->sendpage(sock, page, offset, size, flags);
+	
+	return sock_no_sendpage(sock, page, offset, size, flags);
 }
 
 static struct sock_iocb *alloc_sock_iocb(struct kiocb *iocb,


-- System Information:
Debian Release: 4.0
  APT prefers oldstable
  APT policy: (500, 'oldstable')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.18-6-686
Locale: LANG=en_US, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8)

Message #23 received at 541403-done@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: Stefano <pietranera@gmail.com>

Cc: 541403-done@bugs.debian.org

Subject: Re: linux-image-2.6.26-2-686: Local Privilege Escalation

Date: Thu, 20 Aug 2009 19:10:46 +0200

Version: 2.6.30-6

On Thu, Aug 13, 2009 at 05:43:25PM -045A00, Stefano wrote:
> Package: linux-image-2.6.26-2-686
> Version: 2.6.26-17
> Justification: root security hole
> Severity: critical
> Tags: security
> 
> *** Please type your report below this line ***
> 
> Hi,
> 
> today a serious bug in the Linux Kernel has been discovered and
> disclosed. It affects all 2.4 and 2.6 kernels since 2001 on all
> architectures. 
> 
> See here for more details:
> http://blog.cr0.org/2009/08/linux-null-pointer-dereference-due-to.html
> 
> Hopefully this bug has already been patched:
> http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e694958388c50148389b0e9b9e9e8945cf0f1b98
> 
> I'm pretty sure that you guys already know that, but it is really urgent
> to apply the patch and release an update for the linux-image packages.
> 
> Thank you for your fantastic job.

This was fixed in unstable in 2.6.30-6. The 2.6.18, 2.6.24 and 2.6.26 kernels
from Etch and Lenny have been fixed in DSAs.

Cheers,
        Moritz

Send a report that this bug log contains spam.