Skip to Content.
Sympa Menu

sm-security - Re: [SM-Security] Fw: [PATCH] ioperm fix

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Seth Woolley <seth AT tautology.org>
  • To: Niki Guldbrand <niki AT lunar-linux.org>
  • Cc: sm-security AT lists.ibiblio.org
  • Subject: Re: [SM-Security] Fw: [PATCH] ioperm fix
  • Date: Thu, 22 May 2003 17:34:09 -0700 (PDT)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Thanks Niki... I made a patches/ioperm file for it. When perforce comes
back up, either W0rf or I can just add it and announce it.

I'm testing it right now.

==>
#!/bin/bash

DESCRIPTION="security fix for IO Permissions (local)"
SHORT="security fix for IO Permissions (local)"
HELP="Vulnerability: CAN-2003-0246

The 'ioperm' system call does not properly restrict privileges, potentially
allowing an unprivileged local user access to the I/O ports on the system.

This patch is for 2.4.20
"
VERSIONS="2.4.20"

MD5S[0]=7688fd830a8c26f13c06a58b437b27a2

if [[ "$1" == "CONFIG" ]]; then
echo "
SOURCE${COUNTER}='index.html?m=105364108603938\\&q=raw'
SOURCE${COUNTER}_URL='http://marc.theaimsgroup.com/?m=105364108603938\\&q=raw;FAKE=.tar.bz2'"
>> ${SPELL_CONFIG}.DETAILS
source $SCRIPT_DIRECTORY/MD5PATCH
fi
<==

On Fri, 23 May 2003, Niki Guldbrand wrote:

> Hi W0rf.
>
> Here is a patch which should fix the kernel ioperm security bug, i just
> went into 2.4.21rc3 tonight...
>
>
> diff -Nru a/arch/i386/kernel/ioport.c b/arch/i386/kernel/ioport.c
> --- a/arch/i386/kernel/ioport.c Thu May 22 15:03:32 2003
> +++ b/arch/i386/kernel/ioport.c Thu May 22 15:03:32 2003
> @@ -72,17 +72,18 @@
> */
> memset(t->io_bitmap,0xff,(IO_BITMAP_SIZE+1)*4);
> t->ioperm = 1;
> - /*
> - * this activates it in the TSS
> - */
> - tss->bitmap = IO_BITMAP_OFFSET;
> }
>
> /*
> * do it in the per-thread copy and in the TSS ...
> */
> set_bitmap(t->io_bitmap, from, num, !turn_on);
> - set_bitmap(tss->io_bitmap, from, num, !turn_on);
> + if (tss->bitmap == IO_BITMAP_OFFSET) { /* already active? */
> + set_bitmap(tss->io_bitmap, from, num, !turn_on);
> + } else {
> + memcpy(tss->io_bitmap, t->io_bitmap, IO_BITMAP_SIZE);
> + tss->bitmap = IO_BITMAP_OFFSET; /* Activate it in the TSS */
> + }
>
> return 0;
> }
> _______________________________________________
> SM-Security mailing list
> SM-Security AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-security
> ------------ Output from gpg ------------
> gpg: Signature made Thu May 22 16:50:06 2003 PDT using DSA key ID E0123A3D
> gpg: Good signature from "Niki Guldbrand <Niki AT lunar-linux.org>"
> gpg: WARNING: This key is not certified with a trusted signature!
> gpg: There is no indication that the signature belongs to the
> owner.
> Primary key fingerprint: 4EBD ECCC 2A07 D45B 68B7 B2C8 DC35 47B7 E012 3A3D
>
>

- --
Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (FreeBSD)

iD8DBQE+zWyD7fQ833vqzH0RAuVmAKCu1IYZok3T2DhPh1rRG0ONMyNEUgCcCj9j
GGIfO8gGhStvCW5GUI9INNw=
=yp2B
-----END PGP SIGNATURE-----





Archive powered by MHonArc 2.6.24.

Top of Page