Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 26 Aug 2009 08:07:51 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request - kernel: information leak in sigaltstack

Steve,

On Tue, Aug 18, 2009 at 04:54:43PM -0400, Steven M. Christey wrote:
> On Tue, 4 Aug 2009, Eugene Teo wrote:
> 
> > do_sigaltstack: avoid copying 'stack_t' as a structure to user space
> 
> 
> ======================================================
> Name: CVE-2009-2847
[...]
> The do_sigaltstack function in kernel/signal.c in Linux kernel 2.6
> before 2.6.31-rc5, when running on 64-bit systems, does not clear
> certain padding bytes from a structure, which allows local users to
> obtain sensitive information from the kernel stack via the sigaltstack
> function.

As far as I'm aware, this also affects 2.4 (I did not actively test for
it, but the vulnerable code is there).  I've included a fix for it in
2.4.37.5-ow1, and I expect that Willy will fix it in his next release
(likely 2.4.37.6).

Alexander

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.