Marcelo Tosatti [interview] released the 2.4.29-rc1 Linux kernel with "a SATA update [and a] bunch of network driver updates". He went on to note, "more importantly it fixes a sys_uselib() vulnerability discovered by Paul Starzetz". He adds, "[upgrading] is recommended for users of v2.4.x mainline, distros should be releasing their updates real soon now." The vulnerability allows local users to gain root privileges:

"An analyze of the uselib function load_elf_library() from binfmt_elf.c revealed a flaw in the handling of the library's brk segment (VMA). That segment is created with the current->mm->mmap_sem semaphore NOT held while modifying the memory layout of the calling process. This can be used to disturb the memory management and gain elevated privileges. Also the binfmt_aout binary format loader code is affected in the same way."

The vulnerability also affects the 2.6.10 kernel, as discussed within in a conversation between Marcelo, Alan Cox [interview], and Linus Torvalds. Alan's 2.6-ac patchset [forum] contains a fix, though it appears it will be addressed differently in the mainline.

From: Marcelo Tosatti [email blocked]
To:  linux-kernel
Subject: Linux 2.4.29-rc1
Date: 	Fri, 7 Jan 2005 08:49:13 -0200

Hi, 

Here goes the first release canditate of v2.4.29.

This time it contains a SATA update, bunch of network drivers updates, amongst
others.

More importantly it fixes a sys_uselib() vulnerability discovered by Paul Starzetz:

CAN-2004-1235
http://isec.pl/vulnerabilities/isec-0021-uselib.txt

Upgrade is recommended for users of v2.4.x mainline, distros should be releasing 
their updates real soon now.

Summary of changes from v2.4.29-pre3 to v2.4.29-rc1
============================================

<a.pugachev:pcs-net.net>:
  o drivers/net/appletalk/Config.in depends on CONFIG_ATALK

<albertcc:tw.ibm.com>:
  o [libata] use PIO mode for request sense
  o [libata] PIO error handling improvement
  o [libata] verify ATAPI DMA for a given request is OK

<gortan:tttech.com>:
  o 8139cp: support for TTTech MC322

<jason.d.gaston:intel.com>:
  o SATA support for Intel ICH7

<mbellon:mvista.com>:
  o 32 bit ltrace oops when tracing 64 bit executable [X86_64]

<mhw:wittsend.com>:
  o Computone driver update

<penguin:muskoka.com>:
  o 8390 Tx fix for non i386

<stkn:gentoo.org>:
  o [libata] add #include (fixes 2.4 alpha build)

Don Fry:
  o pcnet32: added pci_disable_device

Ganesh Venkatesan:
  o e1000: ITR does not default correctly on 2.4.x kernels
  o e1000: Fix for kernel panic when the interface is brought down while the NAPI enabled driver is under
           stress
  o e1000: Fix ethtool diagnostics -- specifically for blade server implementations
  o e1000: Enabling NETIF_F_SG without checksum offload is illegal
  o e1000: remove a redundant assignment to a local nr_frags in e1000_xmit_frame
  o e1000: Synchronizing multicast table setup with transmit path - [email blocked]
  o e1000: fix tx resource cleanup logic
  o e1000: {set, get}_wol is now symmetric for 82545EM adapters
  o e1000: Sparse cleanup - [email blocked]
  o e1000: Added workaround to prevent inadvertent gigabit waveform to be sent out on the wire due to
           init-time operations on the IGP phy.
  o e1000: Applied eeprom fix where it was possible to read/write
  o e1000: Applied smart speed fix where the code was forcing smart speed on all the time.  Now it will 
           honor the setting defined in the eeprom.
  o e1000: Driver version number, white spaces, comments, device id & other changes
  o e1000: Documentation/networking/e1000.txt update

Ian Kent:
  o autofs4 add missing compat ioctls

Jean Delvare:
  o I2C: Cleanup a couple media/video drivers

Jeff Garzik:
  o [libata sata_nv] fix dev detect by removing sata-reset flag
  o [libata sata_uli] add 5281 support, fix SATA phy setup for others

Marcelo Tosatti:
  o Changed VERSION to 2.4.29-rc1
  o Paul Starzetz: sys_uselib() race vulnerability  (CAN-2004-1235)

Margit Schubert-While:
  o prism54 sync with 2.6
  o prism54 fix resume processing
  o prism54 sparse fixes

Paul Mackerras:
  o PPC64 signal code cleanup

Pete Zaitcev:
  o USB: Add user defined IDs to ftdi

Ralf Bächle:
  o MIPS network drivers
  o NE2000 on Toshiba RBTX4927 fixes

Solar Designer:
  o Check for zero program header on load_elf_interp()



From: Lukasz Trabinski [email blocked]
To:  linux-kernel
Subject: uselib()  & 2.6.X?
Date: 	Fri, 7 Jan 2005 16:59:22 +0100 (CET)

Hello


http://isec.pl/vulnerabilities/isec-0021-uselib.txt

[...]
Locally  exploitable  flaws  have  been found in the Linux binary format
loaders'  uselib()  functions  that  allow  local  users  to  gain  root
privileges.
[...]
Version:   2.4 up to and including 2.4.29-rc2, 2.6 up to and including 2.6.10
[...]

It's was fixed by Marcelo on 2.4.29-rc1. Thank's :)
What about 2.6.X? Is any patch available? I don't see any changes 
around binfmt_elf in 2.6.10-bk10?



-- 
*[ Łukasz Trąbiński ]*



From: Marcelo Tosatti <marcelo.tosatti@cyclades.com>
Subject: Re: uselib()  & 2.6.X?
Date: 	Fri, 7 Jan 2005 15:07:12 -0200

On Fri, Jan 07, 2005 at 04:59:22PM +0100, Lukasz Trabinski wrote:
> Hello
> 
> 
> http://isec.pl/vulnerabilities/isec-0021-uselib.txt
> 
> [...]
> Locally  exploitable  flaws  have  been found in the Linux binary format
> loaders'  uselib()  functions  that  allow  local  users  to  gain  root
> privileges.
> [...]
> Version:   2.4 up to and including 2.4.29-rc2, 2.6 up to and including 2.6.10
> [...]
> 
> It's was fixed by Marcelo on 2.4.29-rc1. Thank's :)
> What about 2.6.X? Is any patch available? I don't see any changes 
> around binfmt_elf in 2.6.10-bk10?

2.6.10-ac contains a version of the fix.

Attached is what going to be merged in mainline, most likely.

[patch]



From: Alan Cox [email blocked]
Subject: Re: uselib()  & 2.6.X?
Date: 	Fri, 07 Jan 2005 22:49:21 +0000

Please don't use that for mainline - do_brk_locked doesn;t follow kernel
convention and in addition you've made every case you miss (eg outside
code) fail insecure. The original patch you did that I used that adds
__do_brk() not only follows kernel convention but means anyone with
external code will end up with it fixed or with a deadlock that is easy
to track if unlucky.

Silent security failure is *bad*

Alan
 


From: Linus Torvalds [email blocked]
Subject: Re: uselib()  & 2.6.X?
Date: 	Fri, 7 Jan 2005 16:15:28 -0800 (PST)



On Fri, 7 Jan 2005, Alan Cox wrote:
>
> Please don't use that for mainline - do_brk_locked doesn't follow kernel
> convention

I agree, I also find the "do_brk_locked()" naming confusing. To me it 
implies that we already _are_ locked, not that we're going to lock.

On the other hand, I think Alan's patch is equally confusing: the calling 
rules for "do_brk()" and "do_mmap()" are the same, and they are "caller 
takes mmap_sem". 

So I think you _both_ broke kernel conventions.

So I'd personally much prefer to just first fix the bug minimally (by just
taking the lock in the two places that need it), and then _separately_ say
"we should warn if anybody ever calls 'do_brk()' without the lock". That's 
how we tend to verify locking in other cases, ie we have things like

	if (!spin_is_locked(&t->sighand->siglock))
		BUG();

to verify the calling conventions. Same would go for mmap_sem (although we
don't seem to have any "sem_is_writelocked()" test - although you can fake
it with

	if (down_read_trylock(&mm->mmap_sem))
		BUG();

instead.

Now _that_ is a non-silent failure mode. The machine doesn't just silently 
deadlock: it tells you exactly what's wrong.

		Linus

• Archive of above thread [1] [2]
• KernelTrap interview with Marcelo Tosatti