Re: CVE request: information leak / potential crash in sys_move_pages

[Marcus Meissner <meissner () suse de>]

On Sun, Feb 07, 2010 at 02:50:21AM +0100, Marcus Meissner wrote:
> Hi,
>
> I spotted a problem in sys_move_pages, where "node" value is read from userspace,
> but not limited to the node set within the kernel itself.

For the record...

This was reported to Novell Bugzilla by our business partner IBM as a beta test
bug on our Service Pack SLES 11 SP1, from rcvalle@IBM.

The report contained the Ooops backtrace, caused by runs of the "flail" tool,
( http://www.risesecurity.org/ramon/flail-0.1.0.tar.gz )

I spotted this 1 bug in the actual code though and mailed security () kernel org
to get it fixed ASAP for 2.6.33 and our product.

Usually IBM wants to just have their bugs fixed, but this seems to be different
in this case. So sorry for not giving credit where credit is due.

That there was an Oops is however a good indicator that memory corruption
is also possible.

Ciao, Marcus