oss-security - Re: CVE request - kernel: information leak in sigaltstack

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 26 Aug 2009 08:07:51 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request - kernel: information leak in sigaltstack

Steve,

On Tue, Aug 18, 2009 at 04:54:43PM -0400, Steven M. Christey wrote:
> On Tue, 4 Aug 2009, Eugene Teo wrote:
> 
> > do_sigaltstack: avoid copying 'stack_t' as a structure to user space
> 
> 
> ======================================================
> Name: CVE-2009-2847
[...]
> The do_sigaltstack function in kernel/signal.c in Linux kernel 2.6
> before 2.6.31-rc5, when running on 64-bit systems, does not clear
> certain padding bytes from a structure, which allows local users to
> obtain sensitive information from the kernel stack via the sigaltstack
> function.

As far as I'm aware, this also affects 2.4 (I did not actively test for
it, but the vulnerable code is there).  I've included a fix for it in
2.4.37.5-ow1, and I expect that Willy will fix it in his next release
(likely 2.4.37.6).

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.