Bug 933969 (CVE-2015-4178) - VUL-0: CVE-2015-4178: kernel-source: [ns: user namespaces panic -- lack of internal consistency of a datastructure]
Summary: VUL-0: CVE-2015-4178: kernel-source: [ns: user namespaces panic -- lack of in...
Status: RESOLVED UPSTREAM
: CVE-2015-4177 (view as bug list)
Alias: CVE-2015-4178
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/117335/
Whiteboard:
Keywords:
Depends on:
Blocks: CVE-2015-4176
  Show dependency tree / graph
 
Reported: 2015-06-08 17:17 UTC by Marcus Meissner
Modified: 2015-06-14 12:19 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2015-06-08 17:17:46 UTC 
CVE-2015-4178

http://seclists.org/oss-sec/2015/q2/640

Mitre:
Use CVE-2015-4178 for the issue fixed in
820f9f147dcce2602eefd9b575bbbd9ea14f0953. This code change is not
present in 4.0.2.
Comment 1 Marcus Meissner 2015-06-08 17:18:15 UTC 
was introduced in the 4.0 series as far as I see.

original post:

   Hello,

Linux kernel built with the user namespaces support(CONFIG_USER_NS) is vulnerable to a NULL pointer dereference flaw. It could occur when users in user namespaces do unmount mounts.


An unprivileged user could use this flaw to crash the system resulting in DoS.

Upstream fixes:
---------------
  -> https://git.kernel.org/linus/820f9f147dcce2602eefd9b575bbbd9ea14f0953
  -> https://git.kernel.org/linus/cd4a40174b71acd021877341684d8bb1dc8ea4ae

It was introduced by:
---------------------
  -> https://git.kernel.org/linus/ce07d891a0891d3c0d0c2d73d577490486b809e1

Thank you Drew Fisher for reporting this issue to Fedora Security Team.
Comment 2 Swamp Workflow Management 2015-06-08 22:02:02 UTC 
bugbot adjusting priority
Comment 3 Michal Hocko 2015-06-09 08:12:23 UTC 
Doesn't affect TD branches
Comment 4 Borislav Petkov 2015-06-12 10:55:51 UTC 
What Eric Biedermann said:

Neither commit (e0c9c0afd2fc... or cd4a4017...) missing is a problem unless

  ce07d891a089 ("mnt: Honor MNT_LOCKED when detaching mounts")

is present. (I fixed the commit references.)

And ce07d891a089 is not present in any of our trees - it came in in 4.1-rc1 so it'll be in the not yet released 4.1. Btw, the fixes came in at the same time too.

Concerning that pin_fs thing:

  820f9f147dcc ("fs_pin: Allow for the possibility that m_list or s_list go unused.")

that's also not in our trees - it materialized in 3.17.

So we're not affected AFAICT.

Bouncing back to sec team.
Comment 5 Borislav Petkov 2015-06-12 10:57:44 UTC 
*** Bug 933970 has been marked as a duplicate of this bug. ***
Comment 6 Marcus Meissner 2015-06-14 12:19:32 UTC 
problem does not exist in our products.