CVE request: kernel: connector security bypass

Drbd-dev dann frazier 2 participants 3 messages Mar 12, 2010 2 messages not in the archive DRBD driver

lore

Share & tools

lore

A message that is not in the archive (sent off-list or not yet received): [email protected]

dann frazier

author

2010-03-12 09:30 UTC #2 lore raw

Quoted 14 lines · Mark J Cox

Quoted 12 lines · Eugene Teo
1/ uvesafb/connector: Disallow unprivileged users to send netlink packets upstream commit: cc44578b5a508889beb8ae3ccd4d2bbdf17bc86c introduced in v2.6.24-rc1; fixed in v2.6.32-rc3
2/ pohmelfs/connector: Disallow unprivileged users to configure pohmelfs upstream commit: 98a5783af02f4c9b87b676d7bbda6258045cfc76 (staging/experimental)
3/ dst/connector: Disallow unprivileged users to configure dst upstream commit: 5788c56891cfb310e419c4f9ae20427851797431 (staging/experimental)

Quoted 7 lines

Quoted 7 lines
4/ dm/connector: Only process connector packages from privileged processes upstream commit: 24836479a126e02be691e073c2b6cad7e7ab836a introduced in v2.6.31-rc1; fixed in v2.6.32-rc3
References:
http://secunia.com/advisories/37113/
http://xorl.wordpress.com/2009/10/31/linux-kernel-multiple-capabilities-missing-checks/

Debian provides an out-of-tree drbd module (drbd8), and it appears to be affected by this issue as well. I assume we need to allocate an additional CVE ID for it?

Here's a link to the upstream fix:
http://git.drbd.org/?p=drbd-8.3.git;a=commitdiff;h=71915b0d267392c77fe0ae2309535333026cef66

The in-tree version that got merged for 2.6.33 looks fine.

Signature · 1 line

dann frazier

Lars Ellenberg

maintainer

2010-03-12 09:34 UTC #3 lore raw

Quoted 19 lines · dann frazier

Quoted 18 lines · Mark J Cox
Quoted 15 lines · Eugene Teo
1/ uvesafb/connector: Disallow unprivileged users to send netlink packets upstream commit: cc44578b5a508889beb8ae3ccd4d2bbdf17bc86c introduced in v2.6.24-rc1; fixed in v2.6.32-rc3
2/ pohmelfs/connector: Disallow unprivileged users to configure pohmelfs upstream commit: 98a5783af02f4c9b87b676d7bbda6258045cfc76 (staging/experimental)
3/ dst/connector: Disallow unprivileged users to configure dst upstream commit: 5788c56891cfb310e419c4f9ae20427851797431 (staging/experimental)
4/ dm/connector: Only process connector packages from privileged processes upstream commit: 24836479a126e02be691e073c2b6cad7e7ab836a introduced in v2.6.31-rc1; fixed in v2.6.32-rc3

Quoted 7 lines

Quoted 3 lines
Quoted 3 lines
References:
http://secunia.com/advisories/37113/
http://xorl.wordpress.com/2009/10/31/linux-kernel-multiple-capabilities-missing-checks/
Debian provides an out-of-tree drbd module (drbd8), and it appears to be affected by this issue as well. I assume we need to allocate an additional CVE ID for it?

Maybe just go to current upstream drbd 8.3.7?

Quoted 4 lines

Here's a link to the upstream fix:
http://git.drbd.org/?p=drbd-8.3.git;a=commitdiff;h=71915b0d267392c77fe0ae2309535333026cef66
The in-tree version that got merged for 2.6.33 looks fine.

Signature · 5 lines

: Lars Ellenberg
: LINBIT | Your Way to High Availability
: DRBD/HA support and consulting http://www.linbit.com

DRBD® and LINBIT® are registered trademarks of LINBIT, Austria.

dann frazier

author

2010-03-12 22:18 UTC #4 lore raw

Quoted 24 lines · Lars Ellenberg

Quoted 23 lines · dann frazier
Quoted 21 lines · Mark J Cox
Quoted 19 lines · Eugene Teo
1/ uvesafb/connector: Disallow unprivileged users to send netlink packets upstream commit: cc44578b5a508889beb8ae3ccd4d2bbdf17bc86c introduced in v2.6.24-rc1; fixed in v2.6.32-rc3
2/ pohmelfs/connector: Disallow unprivileged users to configure pohmelfs upstream commit: 98a5783af02f4c9b87b676d7bbda6258045cfc76 (staging/experimental)
3/ dst/connector: Disallow unprivileged users to configure dst upstream commit: 5788c56891cfb310e419c4f9ae20427851797431 (staging/experimental)
4/ dm/connector: Only process connector packages from privileged processes upstream commit: 24836479a126e02be691e073c2b6cad7e7ab836a introduced in v2.6.31-rc1; fixed in v2.6.32-rc3
References:
http://secunia.com/advisories/37113/
http://xorl.wordpress.com/2009/10/31/linux-kernel-multiple-capabilities-missing-checks/

Quoted 5 lines

Quoted 3 lines
Debian provides an out-of-tree drbd module (drbd8), and it appears to be affected by this issue as well. I assume we need to allocate an additional CVE ID for it?
Maybe just go to current upstream drbd 8.3.7?

Lars,
Thanks for the suggestion. That is a possible solution for our next
release of Debian (as is moving to the in-tree version), but for our current stable release we have backported "just-the-fix" as required by our security update policy.

Signature · 1 line

dann frazier