Security update patch to 2.6.3 for mremap()?

Security update patch to 2.6.3 for mremap()?

[Nur Hussein]

Greetings,
                                                                                                                             I was searching the source and changelogs of 2.6.3 to find the specific
patch that fixed the recent security hole discovered in mremap()
 
http://isec.pl/vulnerabilities/isec-0014-mremap-unmap.txt
                                                                                                                             I found Andrew Morton's changelog entry that touched mremap:
 
http://linux.bkbits.net:8080/linux-2.5/cset@1.1557.2.83?nav=index.html|ChangeSet@-2d
                                                                                                                             I noticed however, that a fix to the same problem in 2.4.25 sent by
Andrea Arcangeli adds only one line to a different section of code:
 
http://linux.bkbits.net:8080/linux-2.4/diffs/mm/mremap.c@1.7?nav=cset@1.1136.94.4
                                                                                                                             Is this line missing from 2.6.3, or did Andrew Morton's fixes address
the problem already?
 
-= Nur Hussein =-

Re: Security update patch to 2.6.3 for mremap()?

[Diego Calleja García]

El Thu, 19 Feb 2004 22:37:46 +0800 Nur Hussein <obiwan@slackware.org.my> escribió:

>                                                                                                                              I noticed however, that a fix to the same problem in 2.4.25 sent by
> Andrea Arcangeli adds only one line to a different section of code:
>  
> http://linux.bkbits.net:8080/linux-2.4/diffs/mm/mremap.c@1.7?nav=cset@1.1136.94.4

AFAIK, the 2.4 path should be this one, shouldn't it?
http://linux.bkbits.net:8080/linux-2.4/patch@1.1323?nav=index.html|ChangeSet@-2d|cset@1.1323

>                                                                                                                              Is this line missing from 2.6.3, or did Andrew Morton's fixes address
> the problem already?

The 2.6 should be this one (comitted 15 days ago):
http://linux.bkbits.net:8080/linux-2.5/diffs/mm/mremap.c@1.38?nav=index.html|src/|src/mm|hist/mm/mremap.c
2.6.3 is safe, it seems

PD: Your mailer is doing very weird things.

	Diego Calleja

Re: Security update patch to 2.6.3 for mremap()?

[Chris Wright]

* Diego Calleja García (diegocg@teleline.es) wrote:
> El Thu, 19 Feb 2004 22:37:46 +0800 Nur Hussein <obiwan@slackware.org.my> escribió:
> > http://linux.bkbits.net:8080/linux-2.4/diffs/mm/mremap.c@1.7?nav=cset@1.1136.94.4
> 
> AFAIK, the 2.4 path should be this one, shouldn't it?
> http://linux.bkbits.net:8080/linux-2.4/patch@1.1323?nav=index.html|ChangeSet@-2d|cset@1.1323

yep.

> > Is this line missing from 2.6.3, or did Andrew Morton's fixes address 
> > the problem already?
> 
> The 2.6 should be this one (comitted 15 days ago):
> http://linux.bkbits.net:8080/linux-2.5/diffs/mm/mremap.c@1.38?nav=index.html|src/|src/mm|hist/mm/mremap.c
> 2.6.3 is safe, it seems

yep.

thanks,
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net

Re: Security update patch to 2.6.3 for mremap()?

[Nur Hussein]

Thank you for the clarification, and I apologize for my previous email
which went horribly wrong wrt formatting.

> AFAIK, the 2.4 path should be this one, shouldn't it?
> http://linux.bkbits.net:8080/linux-2.4/patch@1.1323?nav=index.html|ChangeSet@-2d|cset@1.1323

> http://linux.bkbits.net:8080/linux-2.5/diffs/mm/mremap.c@1.38?nav=index.html|src/|src/mm|hist/mm/mremap.c
> 2.6.3 is safe, it seems

Yes, those two patches seem to match up.

However, I am still intrigued by this fix:

http://linux.bkbits.net:8080/linux-2.4/diffs/mm/mremap.c@1.7?nav=cset@1.1136.94.4

It does not seem to be in 2.6.3. I can only assume 2.6.x does not
require it? The Changeset says it is to prevent a potential exploit by
the malicious use of mremap().

-= Nur Hussein =-

Re: Security update patch to 2.6.3 for mremap()?

[Chris Wright]

* Nur Hussein (obiwan@slackware.org.my) wrote:
> However, I am still intrigued by this fix:
> 
> http://linux.bkbits.net:8080/linux-2.4/diffs/mm/mremap.c@1.7?nav=cset@1.1136.94.4
> 
> It does not seem to be in 2.6.3. I can only assume 2.6.x does not
> require it? The Changeset says it is to prevent a potential exploit by
> the malicious use of mremap().

It's fixed in 2.6 as well.

http://linux.bkbits.net:8080/linux-2.5/diffs/mm/mremap.c@1.35?nav=index.html|src/|src/mm|hist/mm/mremap.c

thanks,
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net

mremap patches for 2.4 and 2.2?

[Ville Herva]

On Thu, Feb 19, 2004 at 09:56:36AM -0800, you [Chris Wright] wrote:
> * Nur Hussein (obiwan@slackware.org.my) wrote:
> > However, I am still intrigued by this fix:
> > 
> > http://linux.bkbits.net:8080/linux-2.4/diffs/mm/mremap.c@1.7?nav=cset@1.1136.94.4
> > 
> > It does not seem to be in 2.6.3. I can only assume 2.6.x does not
> > require it? The Changeset says it is to prevent a potential exploit by
> > the malicious use of mremap().
> 
> It's fixed in 2.6 as well.
> 
> http://linux.bkbits.net:8080/linux-2.5/diffs/mm/mremap.c@1.35?nav=index.html|src/|src/mm|hist/mm/mremap.c

Are these the sole patches one should apply for this vulnerability if
patching an older 2.4 or 2.6?

Is there a patch for 2.2 somewhere?


-- v --

v@iki.fi

Re: mremap patches for 2.4 and 2.2?

[Andrzej Krzysztofowicz]

> On Thu, Feb 19, 2004 at 09:56:36AM -0800, you [Chris Wright] wrote:
> > * Nur Hussein (obiwan@slackware.org.my) wrote:
> > > However, I am still intrigued by this fix:
> > > 
> > > http://linux.bkbits.net:8080/linux-2.4/diffs/mm/mremap.c@1.7?nav=cset@1.1136.94.4
> > > 
> > > It does not seem to be in 2.6.3. I can only assume 2.6.x does not
> > > require it? The Changeset says it is to prevent a potential exploit by
> > > the malicious use of mremap().
> > 
> > It's fixed in 2.6 as well.
> > 
> > http://linux.bkbits.net:8080/linux-2.5/diffs/mm/mremap.c@1.35?nav=index.html|src/|src/mm|hist/mm/mremap.c
> 
> Are these the sole patches one should apply for this vulnerability if
> patching an older 2.4 or 2.6?
> 
> Is there a patch for 2.2 somewhere?

linux-2.2-mremap-munmap.patch

You can get it from cvs.pld-linux.org CVS or extract from:
ftp://ftp.pld-linux.org/dists/ra/updates/security/SRPMS/kernel-2.2.25-4.src.rpm

-- 
=======================================================================
  Andrzej M. Krzysztofowicz               ankry@mif.pg.gda.pl
  phone (48)(58) 347 14 61
Faculty of Applied Phys. & Math.,   Gdansk University of Technology