* Re: [Drbd-dev] [oss-security] CVE request: kernel: connector security bypass
[not found] ` <0911021136010.7514@mjc.redhat.com>
@ 2010-03-11 22:18 ` dann frazier
2010-03-12 9:34 ` Lars Ellenberg
0 siblings, 1 reply; 3+ messages in thread
From: dann frazier @ 2010-03-11 22:18 UTC (permalink / raw)
To: Steven M. Christey; +Cc: oss-security, drbd-dev
On Mon, Nov 02, 2009 at 11:37:21AM +0000, Mark J Cox wrote:
> On Mon, 2 Nov 2009, Eugene Teo wrote:
>
> >1/ uvesafb/connector: Disallow unprivileged users to send netlink packets
> >upstream commit: cc44578b5a508889beb8ae3ccd4d2bbdf17bc86c
> >introduced in v2.6.24-rc1; fixed in v2.6.32-rc3
> >
> >2/ pohmelfs/connector: Disallow unprivileged users to configure pohmelfs
> >upstream commit: 98a5783af02f4c9b87b676d7bbda6258045cfc76
> >(staging/experimental)
> >
> >3/ dst/connector: Disallow unprivileged users to configure dst
> >upstream commit: 5788c56891cfb310e419c4f9ae20427851797431
> >(staging/experimental)
> >
> >4/ dm/connector: Only process connector packages from privileged processes
> >upstream commit: 24836479a126e02be691e073c2b6cad7e7ab836a
> >introduced in v2.6.31-rc1; fixed in v2.6.32-rc3
>
> >References:
> >http://secunia.com/advisories/37113/
> >http://xorl.wordpress.com/2009/10/31/linux-kernel-multiple-capabilities-missing-checks/
Debian provides an out-of-tree drbd module (drbd8), and it appears to
be affected by this issue as well. I assume we need to allocate an
additional CVE ID for it?
Here's a link to the upstream fix:
http://git.drbd.org/?p=drbd-8.3.git;a=commitdiff;h=71915b0d267392c77fe0ae2309535333026cef66
The in-tree version that got merged for 2.6.33 looks fine.
--
dann frazier
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [Drbd-dev] [oss-security] CVE request: kernel: connector security bypass
2010-03-11 22:18 ` [Drbd-dev] [oss-security] CVE request: kernel: connector security bypass dann frazier
@ 2010-03-12 9:34 ` Lars Ellenberg
2010-03-12 16:47 ` dann frazier
0 siblings, 1 reply; 3+ messages in thread
From: Lars Ellenberg @ 2010-03-12 9:34 UTC (permalink / raw)
To: dann frazier; +Cc: oss-security, drbd-dev, drbd-user, Steven M. Christey
On Thu, Mar 11, 2010 at 03:18:08PM -0700, dann frazier wrote:
> On Mon, Nov 02, 2009 at 11:37:21AM +0000, Mark J Cox wrote:
> > On Mon, 2 Nov 2009, Eugene Teo wrote:
> >
> > >1/ uvesafb/connector: Disallow unprivileged users to send netlink packets
> > >upstream commit: cc44578b5a508889beb8ae3ccd4d2bbdf17bc86c
> > >introduced in v2.6.24-rc1; fixed in v2.6.32-rc3
> > >
> > >2/ pohmelfs/connector: Disallow unprivileged users to configure pohmelfs
> > >upstream commit: 98a5783af02f4c9b87b676d7bbda6258045cfc76
> > >(staging/experimental)
> > >
> > >3/ dst/connector: Disallow unprivileged users to configure dst
> > >upstream commit: 5788c56891cfb310e419c4f9ae20427851797431
> > >(staging/experimental)
> > >
> > >4/ dm/connector: Only process connector packages from privileged processes
> > >upstream commit: 24836479a126e02be691e073c2b6cad7e7ab836a
> > >introduced in v2.6.31-rc1; fixed in v2.6.32-rc3
> >
> > >References:
> > >http://secunia.com/advisories/37113/
> > >http://xorl.wordpress.com/2009/10/31/linux-kernel-multiple-capabilities-missing-checks/
>
> Debian provides an out-of-tree drbd module (drbd8), and it appears to
> be affected by this issue as well. I assume we need to allocate an
> additional CVE ID for it?
Maybe just go to current upstream drbd 8.3.7?
> Here's a link to the upstream fix:
> http://git.drbd.org/?p=drbd-8.3.git;a=commitdiff;h=71915b0d267392c77fe0ae2309535333026cef66
>
> The in-tree version that got merged for 2.6.33 looks fine.
--
: Lars Ellenberg
: LINBIT | Your Way to High Availability
: DRBD/HA support and consulting http://www.linbit.com
DRBD® and LINBIT® are registered trademarks of LINBIT, Austria.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [Drbd-dev] [oss-security] CVE request: kernel: connector security bypass
2010-03-12 9:34 ` Lars Ellenberg
@ 2010-03-12 16:47 ` dann frazier
0 siblings, 0 replies; 3+ messages in thread
From: dann frazier @ 2010-03-12 16:47 UTC (permalink / raw)
To: Steven M. Christey, oss-security, drbd-dev, drbd-user
On Fri, Mar 12, 2010 at 10:34:52AM +0100, Lars Ellenberg wrote:
> On Thu, Mar 11, 2010 at 03:18:08PM -0700, dann frazier wrote:
> > On Mon, Nov 02, 2009 at 11:37:21AM +0000, Mark J Cox wrote:
> > > On Mon, 2 Nov 2009, Eugene Teo wrote:
> > >
> > > >1/ uvesafb/connector: Disallow unprivileged users to send netlink packets
> > > >upstream commit: cc44578b5a508889beb8ae3ccd4d2bbdf17bc86c
> > > >introduced in v2.6.24-rc1; fixed in v2.6.32-rc3
> > > >
> > > >2/ pohmelfs/connector: Disallow unprivileged users to configure pohmelfs
> > > >upstream commit: 98a5783af02f4c9b87b676d7bbda6258045cfc76
> > > >(staging/experimental)
> > > >
> > > >3/ dst/connector: Disallow unprivileged users to configure dst
> > > >upstream commit: 5788c56891cfb310e419c4f9ae20427851797431
> > > >(staging/experimental)
> > > >
> > > >4/ dm/connector: Only process connector packages from privileged processes
> > > >upstream commit: 24836479a126e02be691e073c2b6cad7e7ab836a
> > > >introduced in v2.6.31-rc1; fixed in v2.6.32-rc3
> > >
> > > >References:
> > > >http://secunia.com/advisories/37113/
> > > >http://xorl.wordpress.com/2009/10/31/linux-kernel-multiple-capabilities-missing-checks/
> >
> > Debian provides an out-of-tree drbd module (drbd8), and it appears to
> > be affected by this issue as well. I assume we need to allocate an
> > additional CVE ID for it?
>
> Maybe just go to current upstream drbd 8.3.7?
Lars,
Thanks for the suggestion. That is a possible solution for our next
release of Debian (as is moving to the in-tree version), but for our
current stable release we have backported "just-the-fix" as required
by our security update policy.
--
dann frazier
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2010-03-12 22:18 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <4AEEA8FD.2050601@kernel.sg>
[not found] ` <0911021136010.7514@mjc.redhat.com>
2010-03-11 22:18 ` [Drbd-dev] [oss-security] CVE request: kernel: connector security bypass dann frazier
2010-03-12 9:34 ` Lars Ellenberg
2010-03-12 16:47 ` dann frazier
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox