Security bugs are reported here via bugzilla

[Seth Woolley <seth AT tautology.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Thanks Niki... I made a patches/ioperm file for it.  When perforce comes
back up, either W0rf or I can just add it and announce it.

I'm testing it right now.

==>
#!/bin/bash

DESCRIPTION="security fix for IO Permissions (local)"
SHORT="security fix for IO Permissions (local)"
HELP="Vulnerability: CAN-2003-0246

The 'ioperm' system call does not properly restrict privileges, potentially 
allowing an unprivileged local user access to the I/O ports on the system.

This patch is for 2.4.20
"
VERSIONS="2.4.20"

MD5S[0]=7688fd830a8c26f13c06a58b437b27a2

if [[ "$1" == "CONFIG" ]]; then
echo "
SOURCE${COUNTER}='index.html?m=105364108603938\\&q=raw'
SOURCE${COUNTER}_URL='http://marc.theaimsgroup.com/?m=105364108603938\\&q=raw;FAKE=.tar.bz2'"
 >> ${SPELL_CONFIG}.DETAILS
source $SCRIPT_DIRECTORY/MD5PATCH
fi
<==

On Fri, 23 May 2003, Niki Guldbrand wrote:

> Hi W0rf.
>
> Here is a patch which should fix the kernel ioperm security bug, i just
> went into 2.4.21rc3 tonight...
>
>
> diff -Nru a/arch/i386/kernel/ioport.c b/arch/i386/kernel/ioport.c
> --- a/arch/i386/kernel/ioport.c       Thu May 22 15:03:32 2003
> +++ b/arch/i386/kernel/ioport.c       Thu May 22 15:03:32 2003
> @@ -72,17 +72,18 @@
>                */
>               memset(t->io_bitmap,0xff,(IO_BITMAP_SIZE+1)*4);
>               t->ioperm = 1;
> -             /*
> -              * this activates it in the TSS
> -              */
> -             tss->bitmap = IO_BITMAP_OFFSET;
>       }
>
>       /*
>        * do it in the per-thread copy and in the TSS ...
>        */
>       set_bitmap(t->io_bitmap, from, num, !turn_on);
> -     set_bitmap(tss->io_bitmap, from, num, !turn_on);
> +     if (tss->bitmap == IO_BITMAP_OFFSET) { /* already active? */
> +             set_bitmap(tss->io_bitmap, from, num, !turn_on);
> +     } else {
> +             memcpy(tss->io_bitmap, t->io_bitmap, IO_BITMAP_SIZE);
> +             tss->bitmap = IO_BITMAP_OFFSET; /* Activate it in the TSS */
> +     }
>
>       return 0;
>  }
> _______________________________________________
> SM-Security mailing list
> SM-Security AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-security
> ------------ Output from gpg ------------
> gpg: Signature made Thu May 22 16:50:06 2003 PDT using DSA key ID E0123A3D
> gpg: Good signature from "Niki Guldbrand <Niki AT lunar-linux.org>"
> gpg: WARNING: This key is not certified with a trusted signature!
> gpg:          There is no indication that the signature belongs to the 
> owner.
> Primary key fingerprint: 4EBD ECCC 2A07 D45B 68B7  B2C8 DC35 47B7 E012 3A3D
>
>

- --
Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (FreeBSD)

iD8DBQE+zWyD7fQ833vqzH0RAuVmAKCu1IYZok3T2DhPh1rRG0ONMyNEUgCcCj9j
GGIfO8gGhStvCW5GUI9INNw=
=yp2B
-----END PGP SIGNATURE-----