linux, branch v2.6.17.5

Linux 2.6.17.5

2006-07-15T02:38:43Z

[PATCH] Fix nasty /proc vulnerability (CVE-2006-3626)

2006-07-15T02:35:20Z

Fix nasty /proc vulnerability We have a bad interaction with both the kernel and user space being able to change some of the /proc file status. This fixes the most obvious part of it, but I expect we'll also make it harder for users to modify even their "own" files in /proc. Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman

Linux 2.6.17.4

2006-07-06T20:02:28Z

fix prctl privilege escalation and suid_dumpable (CVE-2006-2451)

2006-07-06T20:02:05Z

Based on a patch from Ernie Petrides During security research, Red Hat discovered a behavioral flaw in core dump handling. A local user could create a program that would cause a core file to be dumped into a directory they would not normally have permissions to write to. This could lead to a denial of service (disk consumption), or allow the local user to gain root privileges. Signed-off-by: Greg Kroah-Hartman

Linux 2.6.17.3

2006-06-30T17:37:38Z

[PATCH] NETFILTER: SCTP conntrack: fix crash triggered by packet without chunks [CVE-2006-2934]

2006-06-30T17:37:31Z

When a packet without any chunks is received, the newconntrack variable in sctp_packet contains an out of bounds value that is used to look up an pointer from the array of timeouts, which is then dereferenced, resulting in a crash. Make sure at least a single chunk is present. Problem noticed by George A. Theall Signed-off-by: Patrick McHardy Signed-off-by: Chris Wright

Linux 2.6.17.2

2006-06-30T00:17:23Z

[PATCH] Input: return correct size when reading modalias attribute

2006-06-30T00:17:17Z

Input: return correct size when reading modalias attribute Signed-off-by: Richard Purdie Signed-off-by: Dmitry Torokhov Signed-off-by: Chris Wright

[PATCH] idr: fix race in idr code

2006-06-30T00:17:17Z

From: Sonny Rao I ran into a bug where the kernel died in the idr code: cpu 0x1d: Vector: 300 (Data Access) at [c000000b7096f710] pc: c0000000001f8984: .idr_get_new_above_int+0x140/0x330 lr: c0000000001f89b4: .idr_get_new_above_int+0x170/0x330 sp: c000000b7096f990 msr: 800000000000b032 dar: 0 dsisr: 40010000 current = 0xc000000b70d43830 paca = 0xc000000000556900 pid = 2022, comm = hwup 1d:mon> t [c000000b7096f990] c0000000000d2ad8 .expand_files+0x2e8/0x364 (unreliable) [c000000b7096faa0] c0000000001f8bf8 .idr_get_new_above+0x18/0x68 [c000000b7096fb20] c00000000002a054 .init_new_context+0x5c/0xf0 [c000000b7096fbc0] c000000000049dc8 .copy_process+0x91c/0x1404 [c000000b7096fcd0] c00000000004a988 .do_fork+0xd8/0x224 [c000000b7096fdc0] c00000000000ebdc .sys_clone+0x5c/0x74 [c000000b7096fe30] c000000000008950 .ppc_clone+0x8/0xc -- Exception: c00 (System Call) at 000000000fde887c SP (f8b4e7a0) is in userspace Turned out to be a race-condition and NULL ptr deref, here's my fix: Users of the idr code are supposed to call idr_pre_get without locking, so the idr code must serialize itself with respect to layer allocations. However, it fails to do so in an error path in idr_get_new_above_int(). I added the missing locking to fix this. Signed-off-by: Sonny Rao Cc: Signed-off-by: Andrew Morton Signed-off-by: Chris Wright

[PATCH] Link error when futexes are disabled on 64bit architectures

2006-06-30T00:17:17Z

From: Anton Blanchard If futexes are disabled we fail to link on ppc64. Signed-off-by: Anton Blanchard Cc: Signed-off-by: Andrew Morton Signed-off-by: Chris Wright