Bugzilla – Bug 726064
VUL-0: CVE-2011-2942: kernel: clock_gettime() panic
Last modified: 2017-04-04 17:58:16 UTC
Via OSS-sec: Date: Mon, 24 Oct 2011 17:16:32 +0800 From: Eugene Teo To: oss-security CVE-2011-2942; In the br_forward_finish() function, we may call kfree() on the skb we are forwarding, and so, after it, we should not dereference skb->dev pointer. With the fix, we save skb->dev before calling the br_forward_finish() function, so that we can use it afterwards. It's a regression from a commit that we have backported to our kernels. It doesn't affect the upstream kernel as the code was rewritten. https://bugzilla.redhat.com/CVE-2011-2942 https://www.redhat.com/security/data/cve/CVE-2011-2942.html CVE-2011-3209; divide error issue in the clock implementation. http://git.kernel.org/linus/f8bd2258e2d520dff28c855658bd24bdafb5102d https://bugzilla.redhat.com/CVE-2011-3209 https://www.redhat.com/security/data/cve/CVE-2011-3209.html Thanks, Eugene -- Eugene Teo / Red Hat Security Response Team
CVE-2011-2942: redhat specific. I looked through sles10 and sles111 br_forward_finish() and its callers apparently do not use skb->dev after calling it. CVE-2011-3209: While the precondition is not triggerable by a user, the actual exploit is ... so it should be fixed.
(In reply to comment #1) [...] > CVE-2011-3209: While the precondition is not triggerable by a user, the actual > exploit is ... so it should be fixed. The fix is from 2008... SLE11-SP1 doesn't have div_long_long_rem and SLES10SP4 doesn't have the optimized version of the function and uses do_div instead. So are we affected?
perl /suse/meissner/bin/addnote CVE-2011-2942 "This problem only affects Redhat kernels. We cross checked that SUSE Linux Enterprise kernels are not affected by this problem."
@mhocko I am wondering if your evaluation is right... I see that sles10 sp4 has: ./include/asm-i386/div64.h: #define div_long_long_rem(a,b,c) div_ll_X_l_rem(a,b,c) static inline long div_ll_X_l_rem(long long divs, long div, long *rem) { long dum2; __asm__("divl %2":"=a"(dum2), "=d"(*rem) : "rm"(div), "A"(divs)); return dum2; } and I think it is the version that would cause the problem here. So I think sles10 sp4 might still be affected.
You are right, Marcus. I have overlooked i386 case. Maybe we should just remove this definition and use the include/linux/calc64.h fallback?
sounds like a good idea to keep the changes minimal
Created attachment 464252 [details] backport for 10sp4 Marcus, could you double check the patch? We will still use do_div implementation from include/asm-i386/div64.h but I guess we should be safe.
looks good to me.
OK, pushed to SLES10_SP4_BRANCH and SLES10-SP3-TD branches. I guess not worth to push it into SLES10_SP3_LTSS, right?
No, it is not necessary for LTSS as there is quite low impact.
OK, then we are done.
The SWAMPID for this issue is 44724. This issue was rated as moderate. Please submit fixed packages until 2012-01-11. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team.
Update released for: kernel-debug, kernel-debug-debuginfo, kernel-default, kernel-default-debuginfo, kernel-kdump, kernel-kdump-debuginfo, kernel-smp, kernel-smp-debuginfo, kernel-source, kernel-source-debuginfo, kernel-syms, kernel-xen, kernel-xen-debuginfo Products: SLE-SERVER 10-SP3-TERADATA (x86_64)
The SWAMPID for this issue is 44839. This issue was rated as moderate. Please submit fixed packages until 2012-01-23. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team.
Update released for: kernel-default, kernel-default-debuginfo, kernel-iseries64, kernel-iseries64-debuginfo, kernel-kdump, kernel-kdump-debuginfo, kernel-ppc64, kernel-ppc64-debuginfo, kernel-source, kernel-source-debuginfo, kernel-syms Products: SLE-DEBUGINFO 10-SP4 (ppc) SLE-SDK 10-SP4 (ppc) SLE-SERVER 10-SP4 (ppc)
Update released for: kernel-debug, kernel-debug-debuginfo, kernel-default, kernel-default-debuginfo, kernel-kdump, kernel-kdump-debuginfo, kernel-smp, kernel-smp-debuginfo, kernel-source, kernel-source-debuginfo, kernel-syms, kernel-xen, kernel-xen-debuginfo Products: SLE-DEBUGINFO 10-SP4 (x86_64) SLE-DESKTOP 10-SP4 (x86_64) SLE-SDK 10-SP4 (x86_64) SLE-SERVER 10-SP4 (x86_64)
Update released for: kernel-debug, kernel-debug-debuginfo, kernel-default, kernel-default-debuginfo, kernel-source, kernel-source-debuginfo, kernel-syms Products: SLE-DEBUGINFO 10-SP4 (ia64) SLE-SDK 10-SP4 (ia64) SLE-SERVER 10-SP4 (ia64)
We have just released a kernel update fixing/mentioning this bug. The released kernel version is 2.6.16.60-0.93.1. (s390x: 2.6.16.60-0.95.1).
Update released for: kernel-default, kernel-default-debuginfo, kernel-source, kernel-syms Products: SLE-DEBUGINFO 10-SP4 (s390x) SLE-SERVER 10-SP4 (s390x)
Update released for: kernel-bigsmp, kernel-bigsmp-debuginfo, kernel-debug, kernel-debug-debuginfo, kernel-default, kernel-default-debuginfo, kernel-kdump, kernel-kdump-debuginfo, kernel-kdumppae, kernel-kdumppae-debuginfo, kernel-smp, kernel-smp-debuginfo, kernel-source, kernel-source-debuginfo, kernel-syms, kernel-syms-debuginfo, kernel-vmi, kernel-vmi-debuginfo, kernel-vmipae, kernel-vmipae-debuginfo, kernel-xen, kernel-xen-debuginfo, kernel-xenpae, kernel-xenpae-debuginfo Products: SLE-DEBUGINFO 10-SP4 (i386) SLE-DESKTOP 10-SP4 (i386) SLE-SDK 10-SP4 (i386) SLE-SERVER 10-SP4 (i386)
The SWAMPID for this issue is 54954. This issue was rated as moderate. Please submit fixed packages until 2013-11-20. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team.
Update released for: kernel-default, kernel-default-debuginfo, kernel-source, kernel-syms Products: SLE-DEBUGINFO 10-SP3 (s390x) SLE-SERVER 10-SP3-LTSS (s390x)
Update released for: kernel-bigsmp, kernel-bigsmp-debuginfo, kernel-debug, kernel-debug-debuginfo, kernel-default, kernel-default-debuginfo, kernel-kdump, kernel-kdump-debuginfo, kernel-kdumppae, kernel-kdumppae-debuginfo, kernel-smp, kernel-smp-debuginfo, kernel-source, kernel-source-debuginfo, kernel-syms, kernel-syms-debuginfo, kernel-vmi, kernel-vmi-debuginfo, kernel-vmipae, kernel-vmipae-debuginfo, kernel-xen, kernel-xen-debuginfo, kernel-xenpae, kernel-xenpae-debuginfo Products: SLE-DEBUGINFO 10-SP3 (i386) SLE-SERVER 10-SP3-LTSS (i386)