The Linux operating system has discovered a serious local privilege escalation vulnerability, which can be exploited to obtain super user permissions of the target system.
The vulnerability exists in the Linux implementation of the Reliable Datagram Socket (RDS) protocol, which affects kernel versions not patched after 2.6.30, because the RDS protocol was introduced in 2.6.30. Security researchers reported that Ubuntu, Debian, Fedora, Red Hat, Arch, Slackware, and SUSE distributions with kernel versions 2.6.30 and later were affected, ubuntu has released official patches. Users of other releases can apply and compile the Corrections released by Linus Torvalds.
De-pessimize rds_page_copy_user
Author |
Linus Torvalds <torvalds@linux-foundation.org> |
|
|
Fri, 15 Oct 2010 18:09:28 + 0000 (-0700) |
Committer |
Linus Torvalds <torvalds@linux-foundation.org> |
|
|
Fri, 15 Oct 2010 18:09:28 + 0000 (-0700) |
Don't try to "optimize" rds_page_copy_user () by using kmap_atomic () and
The unsafe atomic user mode accessor functions. It's actually slower
Than the straightforward code on any reasonable modern CPU.
Back when the code was written (although probably not by the time it was
Actually merged, though), 32-bit x86 may have been the dominant
Architecture. And there kmap_atomic () can be a lot faster than kmap ()
(Unless you have very good locality, in which case the virtual address
Caching by kmap () can overcome all the downsides ).
But these days, x86-64 may not be more populous, but it's getting there
(And if you care about performance, it's definitely already there-
You 'd have upgraded your CPU's already in the last few years). And on
X86-64, the non-kmap_atomic () version is faster, simply because the code
Is simpler and doesn' t have the "re-try page fault" case.
People with old hardware are not likely to care about RDS anyway, and
The optimization for the 32-bit case is simply buggy, since it doesn' t
Verify the user addresses properly.
Reported-by: Dan Lorenz <drosenberg@vsecurity.com>
Acked-by: Andrew Morton <akpm@linux-foundation.org>
HTTP: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Net/rds/page. c |
|
Patch | blob | history |
Diff -- git a/net/rds/page. c B/net/rds/page. cindex 595a952 .. 1 dfbfea 100644 (File)
--- A/net/rds/page. c ++ B/net/rds/page. c -57,30 + 57,17 @@ Int rds_page_copy_user (struct page * page, unsigned long offset,Unsigned long ret; void * addr;-if (to_user) + addr = kmap (page); + if (to_user) {rds_stats_add (s_copy_to_user, bytes ); -else + ret = copy_to_user (ptr, addr + offset, bytes); ++} else {rds_stats_add (s_copy_from_user, bytes); -- addr = kmap_atomic (page, KM_USER0 ); -if (to_user)-ret = _ copy_to_user_inatomic (ptr, addr + offset, bytes);-else-ret = _ copy_from_user_inatomic (addr + offset, ptr, bytes ); -Kunmap_atomic (addr, KM_USER0); -- if (ret) {-addr = kmap (page);-if (to_user)-ret = copy_to_user (ptr, addr + offset, bytes);-else-ret = copy_from_user (addr + offset, ptr, bytes);-kunmap (page);-if (ret)-return-EFAULT; + ret = copy_from_user (addr + offset, ptr, bytes) ;}+ kunmap (page);-return 0; + return ret? -EFAULT: 0;} EXPORT_SYMBOL_GPL (rds_page_copy_user );