oss-security - CVE request: kernel: x86: Fix broken LDT access in VMI

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Fri, 03 Oct 2008 16:55:53 +0800
From: Eugene Teo <eteo@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: kernel: x86: Fix broken LDT access in VMI

This was committed in upstream kernel recently.

"[PATCH] x86: Fix broken LDT access in VMI

After investigating a JRE failure, I found this bug was introduced a
long time ago, and had already managed to survive another bugfix which
occurred on the same line.  The result is a total failure of the JRE due
to LDT selectors not working properly.

This one took a long time to rear up because LDT usage is not very
common, but the bug is quite serious.  It got introduced along with
another bug, already fixed, by 75b8bb3e56ca09a467fbbe5229bc68627f7445be"

This requires a CVE name. In a guest, an unprivileged user can trash the
box's interrupts by calling vmi_write_ldt_entry(), which in turn, writes
to idt_entry (interrupt) instead of ldt_entry (local). Take note that
sys_modify_ldt() does not check for privileges.

Upstream commit: de59985e3a623d4d5d6207f1777398ca0606ab1c
Introduced by: 75b8bb3e56ca09a467fbbe5229bc68627f7445be

Thanks, Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.