Hi.
There is a security bug in 'kernel'.

This information is from 'vendor-sec'.

This bug is NOT PUBLIC.

There is no coordinated release date (CRD) set.

More information can be found here:
	https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec

CVE number: CVE-2007-5494
CVE description: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5494


Original posting:



----- Forwarded message from Mark J Cox <mjc@redhat.com> -----

From: Mark J Cox <mjc@redhat.com>
To: vendor-sec@lst.de
Subject: [vendor-sec] CVE-2007-5494 open(O_ATOMICLOOKUP) leaks dentry [embargoed]
Errors-To: vendor-sec-admin@lst.de
Date: Mon, 19 Nov 2007 09:10:34 +0000 (GMT)

Vasily Averin reported to us under embargo an issue where 
open(O_ATOMICLOOKUP) leaks the dentry on the filesystems where 
d_revalidate is implemented.  This was found to be caused by our tux 
patch, and upstream is not affected.  If anyone here is using the tux 
patch and is affected by this please let me know so we can come up with 
the embargo date.

Testcase: run it in a cycle as a user and watch memory leaks via slabtop

#include <errno.h>
#include <fcntl.h>
#include <stdio.h>
#include <unistd.h>

int
main (int argc, char *argv[])
{
        open ("/proc/self/exe", O_RDONLY);
        open ("/proc/self/exe", O_RDONLY | 02000000);
}

Cause of bug is in our tux patch which adds:

...
need_revalidate:
+       if (atomic)
+               return -EWOULDBLOCKIO;
        if (dentry->d_op->d_revalidate(dentry, nd))
                goto done;
        if (d_invalidate(dentry))

Thanks, Mark
--
Mark J Cox / Red Hat Security Response Team
_______________________________________________
Vendor Security mailing list
Vendor Security@lst.de
https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec

----- End forwarded message -----

-- 
Bye,
     Thomas
-- 
 Thomas Biege <thomas@suse.de>, SUSE LINUX, Security Support & Auditing
 SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)
-- 
	Die meisten Menschen wenden mehr Zeit und Kraft auf,
	um Probleme herumzureden, als sie anzupacken...
					-- Henry Ford I.