Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 22 Aug 2016 15:28:51 +1000
From: Wade Mealing <wmealing@...hat.com>
To: oss-security@...ts.openwall.com, cve-assign@...re.org
Subject: CVE request: Linux kernel mbcache lock contention denial of service.

Gday,

A design flaw was found in the file extended attribute handling of the
linux kernels handling of cached attributes.  Too many entries in the
cache cause a soft lockup while attempting to iterate the cache and
access relevant locks.

Upstream has replaced the mbcache code with an updated version which
was not a patch but a clear-cut reimplementation of the code, no
single diff

Soft lockup information is in both the bugzilla.kernel.org and
referred to in the LWN article.  This would affect containers running
with ext4 as it shares the same mbcache between all containers/host.

This did not affect Red Hat Enterprise Linux versions 5,6 or 7, so I
can't validate the claim that it does affect other newer kernels.
This may be worthwhile tracking for others who are affected by this
flaw.

For those following along at home, this seemed to be fixed in:

 ±  git tag --contains be0726d33cb8f411945884664924bed3cb8c70ee
v4.6

However I can't be sure which factor introduced the issue, but I've
been unable to reproduce with the given instructions.

Thanks,

Wade Mealing
Red Hat Product Security

Upstream discussion:
https://lwn.net/Articles/668718/

Bugzilla kernel submission:
https://bugzilla.kernel.org/show_bug.cgi?id=107301

Red Hat Bugzilla:
https://bugzilla.redhat.com/show_bug.cgi?id=1360968

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ