Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 6 May 2014 14:10:32 +0800
From: Shawn <citypw@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2014-0196: Linux kernel pty layer race
 condition memory corruption

Workable PoC:
http://pastebin.com/yTSFUBgZ

On Mon, May 5, 2014 at 6:08 PM, Marcus Meissner <meissner@...e.de> wrote:
> Hi,
>
> SUSE customer Ericsson reported a kernel crash to us which turned out
> to be a race condition in the PTY write buffer handling.
>
> When two processes/threads write to the same pty, the buffer end could
> be overwritten and so memory corruption into adjacent buffers could lead
> to crashes / code execution.
>
> Jiri Slaby and Peter Hurley localized and fixed this problem.
>
> CVE-2014-0196 has been assigned to this issue.
>
> Jiri thinks this was introduced during 2.6.31 development by
> d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty
> layer to use the normal buffering logic) in 2.6.31-rc3. Until then, pty
> was writing directly to a line discipline without using buffers.
>
> https://bugzilla.novell.com/show_bug.cgi?id=875690
>
> Patch is also attached.
>
> Ciao, Marcus



-- 
GNU powered it...
GPL protect it...
God blessing it...

regards
Shawn

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.