oss-security - CVE request -- Linux kernel: x86/msr: /dev/cpu/*/msr local privilege escalation

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130207105518.GX9348@dhcp-25-225.brq.redhat.com>
Date: Thu, 7 Feb 2013 11:55:19 +0100
From: Petr Matousek <pmatouse@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Kurt Seifried <kseifrie@...hat.com>, spender@...ecurity.net
Subject: CVE request -- Linux kernel: x86/msr: /dev/cpu/*/msr local privilege
 escalation

Access to /dev/cpu/*/msr was protected only using filesystem checks. A
local uid 0 (root) user with all capabilities dropped could use this
flaw to execute arbitrary code in kernel mode.

Upstream commit:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=commitdiff;h=c903f0456bc69176912dee6dd25c6a66ee1aed00

References:
https://bugzilla.redhat.com/show_bug.cgi?id=908693
http://grsecurity.net/~spender/msr32.c

Thanks,
-- 
Petr Matousek / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.