Bugzilla – Bug 917839
VUL-0: CVE-2015-1593: kernel: reduced entropy in stack randomisation
Last modified: 2017-09-20 14:37:08 UTC
An integer overflow in the stack randomisation function slightly reduces the entropy of the stack randomisation on x86_64 to one fourth of the expected entropy, making ASLR http://hmarco.org/bugs/linux-ASLR-integer-overflow.html https://lkml.org/lkml/2015/1/7/656
To reproduce: $ for i in `seq 1 10`; do cat /proc/self/maps | grep stack; done 7fff612ab000-7fff612cc000 rw-p 00000000 00:00 0 [stack] 7fff7df8d000-7fff7dfae000 rw-p 00000000 00:00 0 [stack] 7fff9b738000-7fff9b759000 rw-p 00000000 00:00 0 [stack] 7fff915db000-7fff915fc000 rw-p 00000000 00:00 0 [stack] 7fffa4111000-7fffa4132000 rw-p 00000000 00:00 0 [stack] 7fff1f272000-7fff1f293000 rw-p 00000000 00:00 0 [stack] 7fffa5831000-7fffa5852000 rw-p 00000000 00:00 0 [stack] 7fff10ac5000-7fff10ae6000 rw-p 00000000 00:00 0 [stack] 7fffeb039000-7fffeb05a000 rw-p 00000000 00:00 0 [stack] 7fff807b6000-7fff807d7000 rw-p 00000000 00:00 0 [stack] ^^^^ always shows 7FFF. When fixed, covers range from 7FFC to 7FFD.
Created attachment 623243 [details] patch from security researchers
No CVE right now. CVE request: http://www.openwall.com/lists/oss-security/2015/02/13/4
bugbot adjusting priority
CVE-2015-1593 was assigned
Fix: https://lkml.org/lkml/2015/2/14/61
Boris, one that you could check out :)
Created attachment 623377 [details] updated patch https://lkml.org/lkml/2015/2/14/61
Ok, pinged Viro to pick it up.
Ok, I picked it up and it is going to tip next week, if no one objects in the meantime. It is CCed to stable so it'll reach SLE12 automatically, the rest of the susies will get it backported next week too.
Ok, patch works (this is on 11SP3): before: for i in `seq 1 10`; do cat /proc/self/maps | grep stack; done 7fffc852a000-7fffc854b000 rw-p 00000000 00:00 0 [stack] 7fff7bfcf000-7fff7bff0000 rw-p 00000000 00:00 0 [stack] 7fff50c64000-7fff50c85000 rw-p 00000000 00:00 0 [stack] 7fff7deaa000-7fff7decb000 rw-p 00000000 00:00 0 [stack] 7fff96468000-7fff96489000 rw-p 00000000 00:00 0 [stack] 7fff865dc000-7fff865fd000 rw-p 00000000 00:00 0 [stack] 7fff9e9cb000-7fff9e9ec000 rw-p 00000000 00:00 0 [stack] 7fff314c8000-7fff314e9000 rw-p 00000000 00:00 0 [stack] 7fff905ca000-7fff905eb000 rw-p 00000000 00:00 0 [stack] 7fff73d13000-7fff73d34000 rw-p 00000000 00:00 0 [stack] after: for i in `seq 1 10`; do cat /proc/self/maps | grep stack; done 7ffea23ee000-7ffea240f000 rw-p 00000000 00:00 0 [stack] 7ffe5bc18000-7ffe5bc39000 rw-p 00000000 00:00 0 [stack] 7ffc616a6000-7ffc616c7000 rw-p 00000000 00:00 0 [stack] 7ffde02ed000-7ffde030e000 rw-p 00000000 00:00 0 [stack] 7ffc4e7e5000-7ffc4e806000 rw-p 00000000 00:00 0 [stack] 7fff36db2000-7fff36dd3000 rw-p 00000000 00:00 0 [stack] 7ffe94a62000-7ffe94a83000 rw-p 00000000 00:00 0 [stack] 7ffd090f1000-7ffd09112000 rw-p 00000000 00:00 0 [stack] 7fff405f1000-7fff40612000 rw-p 00000000 00:00 0 [stack] 7ffc99ff9000-7ffc9a01a000 rw-p 00000000 00:00 0 [stack]
Applied to 11-SP3, SP4 will get it automatically. mhocko, you might want to pick it up for TD.
Applied to oS13.{1,2}.
Boris, do I understand it correctly and the issue has been caused by 80938332d8cf (x86: Increase MIN_GAP to include randomized stack)?
pushed to SLE11-SP1-TD branch.
An update workflow for this issue was started. This issue was rated as important. Please submit fixed packages until 2015-03-05. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/60808
Second issue looking very similar, no CVE assigned yet: http://hmarco.org/bugs/linux-ASLR-reducing-mmap-by-half.html Reproducer 2: ( $ for i in `seq 1 10`; do cat /proc/self/maps | grep vdso ; done 7fa4b50000-7fa4b51000 r-xp 00000000 00:00 0 [vdso] 7f927ba000-7f927bb000 r-xp 00000000 00:00 0 [vdso] 7f8d3b6000-7f8d3b7000 r-xp 00000000 00:00 0 [vdso] 7fb4d12000-7fb4d13000 r-xp 00000000 00:00 0 [vdso] 7fb4bd2000-7fb4bd3000 r-xp 00000000 00:00 0 [vdso] 7fb5f9c000-7fb5f9d000 r-xp 00000000 00:00 0 [vdso] 7f7b668000-7f7b669000 r-xp 00000000 00:00 0 [vdso] 7fa8a40000-7fa8a41000 r-xp 00000000 00:00 0 [vdso] 7f7cb2e000-7f7cb2f000 r-xp 00000000 00:00 0 [vdso] 7f9068a000-7f9068b000 r-xp 00000000 00:00 0 [vdso] ^ uneven 113579bdf ^ ) It lists 6 commits between 2009 and 2014 with different times for when this affected different architectures.
Adding Dinar for PPC. Who does ARM?
Ok, so the x86 aspect is solved, assigning to Dinar for PPC. @Dinar: if you're not the right guy for this, please reassign to whoever is supposed to deal with this for PPC. Reportedly, bug in comment #19 talks about ARM64 being affected too so this bugzilla should be looked at by an ARM person too, so assign to an ARM person after you've done please. Thanks.
SUSE-SU-2015:0581-1: An update that solves 21 vulnerabilities and has 67 fixes is now available. Category: security (important) Bug References: 771619,816099,829110,833588,833820,846656,853040,856760,864401,864404,864409,864411,865419,875051,876086,876594,877593,882470,883948,884817,887597,891277,894213,895841,896484,900279,900644,902232,902349,902351,902675,903096,903640,904053,904242,904659,904671,905304,905312,905799,906586,907196,907338,907551,907611,907818,908069,908163,908393,908550,908551,908572,908825,909077,909078,909088,909092,909093,909095,909264,909565,909740,909846,910013,910150,910159,910321,910322,910517,911181,911325,911326,912171,912705,913059,914355,914423,914726,915209,915322,915335,915791,915826,916515,916982,917839,917884,920250 CVE References: CVE-2013-7263,CVE-2014-0181,CVE-2014-3687,CVE-2014-3688,CVE-2014-3690,CVE-2014-4608,CVE-2014-7822,CVE-2014-7842,CVE-2014-7970,CVE-2014-8133,CVE-2014-8134,CVE-2014-8160,CVE-2014-8369,CVE-2014-8559,CVE-2014-9090,CVE-2014-9322,CVE-2014-9419,CVE-2014-9420,CVE-2014-9584,CVE-2014-9585,CVE-2015-1593 Sources used: SUSE Linux Enterprise Server 11 SP3 for VMware (src): kernel-bigsmp-3.0.101-0.47.50.1, kernel-default-3.0.101-0.47.50.1, kernel-pae-3.0.101-0.47.50.1, kernel-source-3.0.101-0.47.50.1, kernel-syms-3.0.101-0.47.50.1, kernel-trace-3.0.101-0.47.50.1, kernel-xen-3.0.101-0.47.50.1 SUSE Linux Enterprise Server 11 SP3 (src): kernel-bigsmp-3.0.101-0.47.50.1, kernel-default-3.0.101-0.47.50.1, kernel-ec2-3.0.101-0.47.50.1, kernel-pae-3.0.101-0.47.50.1, kernel-ppc64-3.0.101-0.47.50.1, kernel-source-3.0.101-0.47.50.1, kernel-syms-3.0.101-0.47.50.1, kernel-trace-3.0.101-0.47.50.1, kernel-xen-3.0.101-0.47.50.1, xen-4.2.5_04-0.7.1 SUSE Linux Enterprise High Availability Extension 11 SP3 (src): cluster-network-1.4-2.28.1.7, gfs2-2-0.17.1.7, ocfs2-1.6-0.21.1.7 SUSE Linux Enterprise Desktop 11 SP3 (src): kernel-bigsmp-3.0.101-0.47.50.1, kernel-default-3.0.101-0.47.50.1, kernel-pae-3.0.101-0.47.50.1, kernel-source-3.0.101-0.47.50.1, kernel-syms-3.0.101-0.47.50.1, kernel-trace-3.0.101-0.47.50.1, kernel-xen-3.0.101-0.47.50.1, xen-4.2.5_04-0.7.1 SLE 11 SERVER Unsupported Extras (src): kernel-bigsmp-3.0.101-0.47.50.1, kernel-default-3.0.101-0.47.50.1, kernel-pae-3.0.101-0.47.50.1, kernel-ppc64-3.0.101-0.47.50.1, kernel-xen-3.0.101-0.47.50.1
An update workflow for this issue was started. This issue was rated as important. Please submit fixed packages until 2015-04-01. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/61308
Submitted to SLE11-SP3 PowerPC only affected on kernels prior 3.2
Passing to ARM. Alex are you the right person?
hi,all does this bug effect on sles10 SPx? some customer asked this question, and I'm not sure about it. Thanks
openSUSE-SU-2015:0713-1: An update that solves 13 vulnerabilities and has 52 fixes is now available. Category: security (important) Bug References: 867199,893428,895797,900811,901925,903589,903640,904899,905681,907039,907818,907988,908582,908588,908589,908592,908593,908594,908596,908598,908603,908604,908605,908606,908608,908610,908612,909077,909078,909477,909634,910150,910322,910440,911311,911325,911326,911356,911438,911578,911835,912061,912202,912429,912705,913059,913466,913695,914175,915425,915454,915456,915577,915858,916608,917830,917839,918954,918970,919463,920581,920604,921313,922542,922944 CVE References: CVE-2014-8134,CVE-2014-8160,CVE-2014-8559,CVE-2014-9419,CVE-2014-9420,CVE-2014-9428,CVE-2014-9529,CVE-2014-9584,CVE-2014-9585,CVE-2015-0777,CVE-2015-1421,CVE-2015-1593,CVE-2015-2150 Sources used: openSUSE 13.2 (src): bbswitch-0.8-3.6.6, cloop-2.639-14.6.6, crash-7.0.8-6.6, hdjmod-1.28-18.7.6, ipset-6.23-6.6, kernel-docs-3.16.7-13.2, kernel-obs-build-3.16.7-13.7, kernel-obs-qa-3.16.7-13.1, kernel-obs-qa-xen-3.16.7-13.1, kernel-source-3.16.7-13.1, kernel-syms-3.16.7-13.1, pcfclock-0.44-260.6.2, vhba-kmp-20140629-2.6.2, virtualbox-4.3.20-10.2, xen-4.4.1_08-12.2, xtables-addons-2.6-6.2
openSUSE-SU-2015:0714-1: An update that solves 11 vulnerabilities and has 5 fixes is now available. Category: security (important) Bug References: 903640,904899,907988,909078,910150,911325,911326,912202,912654,912705,913059,913695,914175,915322,917839,920901 CVE References: CVE-2014-7822,CVE-2014-8134,CVE-2014-8160,CVE-2014-8173,CVE-2014-8559,CVE-2014-9419,CVE-2014-9420,CVE-2014-9529,CVE-2014-9584,CVE-2014-9585,CVE-2015-1593 Sources used: openSUSE 13.1 (src): cloop-2.639-11.19.1, crash-7.0.2-2.19.1, hdjmod-1.28-16.19.1, ipset-6.21.1-2.23.1, iscsitarget-1.4.20.3-13.19.1, kernel-docs-3.11.10-29.2, kernel-source-3.11.10-29.1, kernel-syms-3.11.10-29.1, ndiswrapper-1.58-19.1, pcfclock-0.44-258.19.1, vhba-kmp-20130607-2.20.1, virtualbox-4.2.28-2.28.1, xen-4.3.3_04-37.1, xtables-addons-2.3-2.19.1
SUSE-SU-2015:0736-1: An update that solves 21 vulnerabilities and has 69 fixes is now available. Category: security (important) Bug References: 771619,816099,829110,833588,833820,846656,853040,856760,864401,864404,864409,864411,865419,875051,876086,876594,877593,882470,883948,884817,887597,891277,894213,895841,896484,900279,900644,902232,902349,902351,902675,903096,903640,904053,904242,904659,904671,905304,905312,905799,906586,907196,907338,907551,907611,907818,908069,908163,908393,908550,908551,908572,908825,909077,909078,909088,909092,909093,909095,909264,909565,909740,909846,910013,910150,910159,910251,910321,910322,910517,911181,911325,911326,912171,912705,913059,914355,914423,914726,915209,915322,915335,915791,915826,916515,916982,917839,917884,920250,924282 CVE References: CVE-2013-7263,CVE-2014-0181,CVE-2014-3687,CVE-2014-3688,CVE-2014-3690,CVE-2014-4608,CVE-2014-7822,CVE-2014-7842,CVE-2014-7970,CVE-2014-8133,CVE-2014-8134,CVE-2014-8160,CVE-2014-8369,CVE-2014-8559,CVE-2014-9090,CVE-2014-9322,CVE-2014-9419,CVE-2014-9420,CVE-2014-9584,CVE-2014-9585,CVE-2015-1593 Sources used: SUSE Linux Enterprise Real Time Extension 11 SP3 (src): cluster-network-1.4-2.28.1.14, drbd-kmp-8.4.4-0.23.1.14, iscsitarget-1.4.20-0.39.1.14, kernel-rt-3.0.101.rt130-0.33.36.1, kernel-rt_trace-3.0.101.rt130-0.33.36.1, kernel-source-rt-3.0.101.rt130-0.33.36.1, kernel-syms-rt-3.0.101.rt130-0.33.36.1, lttng-modules-2.1.1-0.12.1.13, ocfs2-1.6-0.21.1.14, ofed-1.5.4.1-0.14.1.14
An update workflow for this issue was started. This issue was rated as moderate. Please submit fixed packages until 2015-06-12. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/61844
An update workflow for this issue was started. This issue was rated as important. Please submit fixed packages until 2015-06-15. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/61904
SUSE-SU-2015:1174-1: An update that solves 15 vulnerabilities and has 71 fixes is now available. Category: security (moderate) Bug References: 831029,877456,889221,891212,891641,900881,902286,904242,904883,904901,906027,908706,909309,909312,909477,909684,910517,911326,912202,912741,913080,913598,914726,914742,914818,914987,915045,915200,915577,916521,916848,917093,917120,917648,917684,917830,917839,918333,919007,919018,919357,919463,919589,919682,919808,921769,922583,923344,924142,924271,924333,924340,925012,925370,925443,925567,925729,926016,926240,926439,926767,927190,927257,927262,927338,928122,928130,928142,928333,928970,929145,929148,929283,929525,929647,930145,930171,930226,930284,930401,930669,930786,930788,931014,931015,931850 CVE References: CVE-2014-8086,CVE-2014-8159,CVE-2014-9419,CVE-2014-9529,CVE-2014-9683,CVE-2015-0777,CVE-2015-1421,CVE-2015-2041,CVE-2015-2042,CVE-2015-2150,CVE-2015-2830,CVE-2015-2922,CVE-2015-3331,CVE-2015-3339,CVE-2015-3636 Sources used: SUSE Linux Enterprise Server 11 SP3 for VMware (src): kernel-bigsmp-3.0.101-0.47.55.1, kernel-default-3.0.101-0.47.55.1, kernel-pae-3.0.101-0.47.55.1, kernel-source-3.0.101-0.47.55.1, kernel-syms-3.0.101-0.47.55.1, kernel-trace-3.0.101-0.47.55.1, kernel-xen-3.0.101-0.47.55.1 SUSE Linux Enterprise Server 11 SP3 (src): kernel-bigsmp-3.0.101-0.47.55.1, kernel-default-3.0.101-0.47.55.1, kernel-ec2-3.0.101-0.47.55.1, kernel-pae-3.0.101-0.47.55.1, kernel-ppc64-3.0.101-0.47.55.1, kernel-source-3.0.101-0.47.55.1, kernel-syms-3.0.101-0.47.55.1, kernel-trace-3.0.101-0.47.55.1, kernel-xen-3.0.101-0.47.55.1, xen-4.2.5_08-0.7.1 SUSE Linux Enterprise High Availability Extension 11 SP3 (src): cluster-network-1.4-2.28.1.21, gfs2-2-0.17.1.21, ocfs2-1.6-0.21.1.21 SUSE Linux Enterprise Desktop 11 SP3 (src): kernel-bigsmp-3.0.101-0.47.55.1, kernel-default-3.0.101-0.47.55.1, kernel-pae-3.0.101-0.47.55.1, kernel-source-3.0.101-0.47.55.1, kernel-syms-3.0.101-0.47.55.1, kernel-trace-3.0.101-0.47.55.1, kernel-xen-3.0.101-0.47.55.1, xen-4.2.5_08-0.7.1 SLE 11 SERVER Unsupported Extras (src): kernel-bigsmp-3.0.101-0.47.55.1, kernel-default-3.0.101-0.47.55.1, kernel-pae-3.0.101-0.47.55.1, kernel-ppc64-3.0.101-0.47.55.1, kernel-xen-3.0.101-0.47.55.1
SUSE-SU-2015:1376-1: An update that solves 15 vulnerabilities and has 71 fixes is now available. Category: security (important) Bug References: 831029,877456,889221,891212,891641,900881,902286,904242,904883,904901,906027,908706,909309,909312,909477,909684,910517,911326,912202,912741,913080,913598,914726,914742,914818,914987,915045,915200,915577,916521,916848,917093,917120,917648,917684,917830,917839,918333,919007,919018,919357,919463,919589,919682,919808,921769,922583,923344,924142,924271,924333,924340,925012,925370,925443,925567,925729,926016,926240,926439,926767,927190,927257,927262,927338,928122,928130,928142,928333,928970,929145,929148,929283,929525,929647,930145,930171,930226,930284,930401,930669,930786,930788,931014,931015,931850 CVE References: CVE-2014-8086,CVE-2014-8159,CVE-2014-9419,CVE-2014-9529,CVE-2014-9683,CVE-2015-0777,CVE-2015-1421,CVE-2015-2041,CVE-2015-2042,CVE-2015-2150,CVE-2015-2830,CVE-2015-2922,CVE-2015-3331,CVE-2015-3339,CVE-2015-3636 Sources used: SUSE Linux Enterprise Real Time Extension 11 SP3 (src): cluster-network-1.4-2.28.1.22, drbd-kmp-8.4.4-0.23.1.22, iscsitarget-1.4.20-0.39.1.22, kernel-rt-3.0.101.rt130-0.33.38.1, kernel-rt_trace-3.0.101.rt130-0.33.38.1, kernel-source-rt-3.0.101.rt130-0.33.38.1, kernel-syms-rt-3.0.101.rt130-0.33.38.1, lttng-modules-2.1.1-0.12.1.20, ocfs2-1.6-0.21.1.22, ofed-1.5.4.1-0.14.1.22
An update workflow for this issue was started. This issue was rated as important. Please submit fixed packages until 2015-11-24. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/62340
Could you please release PTF for sles10sp3 ltss? Should i new a SR for it?
(In reply to fu xinrong from comment #45) > Could you please release PTF for sles10sp3 ltss? > Should i new a SR for it? Open an L3 request and L3 people will build a PTF for you.
For SLE12 it is in patches.kernel.org/patch-3.12.38-39
done i think