oss-security - Re: CVE request: kernel: tty: release_one

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4BD68D09.9050803@redhat.com>
Date: Tue, 27 Apr 2010 15:06:49 +0800
From: Eugene Teo <eugene@...hat.com>
To: oss-security@...ts.openwall.com
CC: Eren Türkay <eren@...dus.org.tr>
Subject: Re: CVE request: kernel: tty: release_one_tty() forgets
 to put pids

On 04/27/2010 02:45 PM, Eren Türkay wrote:
> On Thu, Apr 15, 2010 at 08:44:53AM +0800, Eugene Teo wrote:
>> pgrp member in struct tty_struct was converted to struct pid in
>> commit ab521dc0, so kernels of version v2.6.26-rc1 and above are
>> affected by this.
>
> FYI. We use v2.6.25.20 in one of our products. As far as I see from
> include/linux/tty.h in 2.6.25 archive that pgrp member in tty_struct is already converted
> to "struct pid". I haven't checked the older kernel releases but this
> issue exists in 2.6.25. It would be very helpful if someone checked
> older kernel releases to correctly determine which releases are vulnerable.

Happy to know that someone reads this :) You spotted a typo.

Upstream ab521dc0 was introduced in v2.6.21-rc1.

commit ab521dc0f8e117fd808d3e425216864d60390500
Author: Eric W. Biederman <ebiederm@...ssion.com>
Date:   Mon Feb 12 00:53:00 2007 -0800

     [PATCH] tty: update the tty layer to work with struct pid
[...]

@@ -197,8 +197,8 @@ struct tty_struct {
         struct mutex termios_mutex;
         struct ktermios *termios, *termios_locked;
         char name[64];
-       int pgrp;
-       int session;
+       struct pid *pgrp;

Thanks, Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.