oss-security - CVE request: kernel: x86: Fix broken LDT access in VMI

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [thread-next>] [month] [year] [list]

Date: Fri, 03 Oct 2008 16:55:53 +0800
From: Eugene Teo <eteo@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: kernel: x86: Fix broken LDT access in VMI

This was committed in upstream kernel recently.

"[PATCH] x86: Fix broken LDT access in VMI

After investigating a JRE failure, I found this bug was introduced a
long time ago, and had already managed to survive another bugfix which
occurred on the same line.  The result is a total failure of the JRE due
to LDT selectors not working properly.

This one took a long time to rear up because LDT usage is not very
common, but the bug is quite serious.  It got introduced along with
another bug, already fixed, by 75b8bb3e56ca09a467fbbe5229bc68627f7445be"

This requires a CVE name. In a guest, an unprivileged user can trash the
box's interrupts by calling vmi_write_ldt_entry(), which in turn, writes
to idt_entry (interrupt) instead of ldt_entry (local). Take note that
sys_modify_ldt() does not check for privileges.

Upstream commit: de59985e3a623d4d5d6207f1777398ca0606ab1c
Introduced by: 75b8bb3e56ca09a467fbbe5229bc68627f7445be

Thanks, Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.