Date: Fri, 03 Oct 2008 16:55:53 +0800 From: Eugene Teo <eteo@...hat.com> To: oss-security@...ts.openwall.com Subject: CVE request: kernel: x86: Fix broken LDT access in VMI This was committed in upstream kernel recently. "[PATCH] x86: Fix broken LDT access in VMI After investigating a JRE failure, I found this bug was introduced a long time ago, and had already managed to survive another bugfix which occurred on the same line. The result is a total failure of the JRE due to LDT selectors not working properly. This one took a long time to rear up because LDT usage is not very common, but the bug is quite serious. It got introduced along with another bug, already fixed, by 75b8bb3e56ca09a467fbbe5229bc68627f7445be" This requires a CVE name. In a guest, an unprivileged user can trash the box's interrupts by calling vmi_write_ldt_entry(), which in turn, writes to idt_entry (interrupt) instead of ldt_entry (local). Take note that sys_modify_ldt() does not check for privileges. Upstream commit: de59985e3a623d4d5d6207f1777398ca0606ab1c Introduced by: 75b8bb3e56ca09a467fbbe5229bc68627f7445be Thanks, Eugene
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.