Re: Linux kernel futex local privilege escalation (CVE-2014-3153)

[Greg KH <greg () kroah com>]

On Thu, Jun 05, 2014 at 07:24:30PM +0400, Solar Designer wrote:
> Greg, Thomas -
>
> On Thu, Jun 05, 2014 at 06:45:45PM +0400, Solar Designer wrote:
> > This was handled via linux-distros, hence the mandatory oss-security
> > posting.  The issue was made public earlier today, and is included in
> > this Debian advisory:
> >
> > https://lists.debian.org/debian-security-announce/2014/msg00130.html
> >
> > ---
> > CVE-2014-3153
> >
> >     Pinkie Pie discovered an issue in the futex subsystem that allows a
> >     local user to gain ring 0 control via the futex syscall. An
> >     unprivileged user could use this flaw to crash the kernel (resulting
> >     in denial of service) or for privilege escalation.
> > ---
> >
> > I've attached patches by Thomas Gleixner (four e-mails, in mbox format),
>
> Can you comment on how the four patches:
>
> Subject: [patch 1/4] futex-prevent-requeue-pi-on-same-futex.patch
> Subject: [patch 2/4] futex: Validate atomic acquisition in
> Subject: [patch 3/4] futex: Always cleanup owner tid in unlock_pi
> Subject: [patch 4/4] futex: Make lookup_pi_state more robust

Those have to go on top of:

> relate to these two on LKML:
>
> Subject: [PATCH 3.14 001/228] futex: Add another early deadlock detection check
> Subject: [PATCH 3.14 002/228] futex: Prevent attaching to kernel threads

These, as these two patches are already in Linus's tree.

Now if these two are needed for the first 4 to work properly, that I do
not know, Thomas might.  I see no reason why a distro would not want
these two patches anyway, as they made the stable kernel criteria.

thanks,

greg k-h