[PATCH 0/3] CVE-2010-4248

[Brad Figg]

Following this email will be three patches associated with this CVE. The
patches cover Hardy, Karmic and Maverick. This CVE has already been fixed
in Lucid via an upstream stable release.

    CVE-2010-4248
    
    BugLink: http://bugs.launchpad.net/bugs/712609
    
    posix-cpu-timers.c correctly assumes that the dying process does
    posix_cpu_timers_exit_group() and removes all !CPUCLOCK_PERTHREAD
    timers from signal->cpu_timers list.
    
    But, it also assumes that timer->it.cpu.task is always the group
    leader, and thus the dead ->task means the dead thread group.
    
    This is obviously not true after de_thread() changes the leader.
    After that almost every posix_cpu_timer_ method has problems.
    
    It is not simple to fix this bug correctly. First of all, I think
    that timer->it.cpu should use struct pid instead of task_struct.
    Also, the locking should be reworked completely. In particular,
    tasklist_lock should not be used at all. This all needs a lot of
    nontrivial and hard-to-test changes.
    
    Change __exit_signal() to do posix_cpu_timers_exit_group() when
    the old leader dies during exec. This is not the fix, just the
    temporary hack to hide the problem for 2.6.37 and stable. IOW,
    this is obviously wrong but this is what we currently have anyway:
    cpu timers do not work after mt exec.
    
    In theory this change adds another race. The exiting leader can
    detach the timers which were attached to the new leader. However,
    the window between de_thread() and release_task() is small, we
    can pretend that sys_timer_create() was called before de_thread().
    
    Signed-off-by: Oleg Nesterov <oleg at redhat.com>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
    
    (cherry-picked from commit e0a70217107e6f9844628120412cb27bb4cea194)
    Signed-off-by: Brad Figg <brad.figg at canonical.com>




Oleg Nesterov (1):
  posix-cpu-timers: workaround to suppress the problems with mt exec,
    CVE-2010-4248

 kernel/exit.c |    8 ++++++++
 1 files changed, 8 insertions(+), 0 deletions(-)