Re: CVE-2014-4699: Linux ptrace bug

[Solar Designer <solar () openwall com>]

On Sat, Jul 05, 2014 at 10:25:47PM +0400, Solar Designer wrote:
> Here are some distro vendor status pages on this bug:
>
> "x86_64,ptrace: Enforce RIP <= TASK_SIZE_MAX (CVE-2014-4699)"
> https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1337339
>
> Ubuntu has just sent out 7 update announcements (for different of their
> supported distros/kernels), USN-2266-1 through USN-2272-1.

and USN-2274-1

> "ptrace,x86: force IRET path after a ptrace_stop()"
> http://kernel.opensuse.org/cgit/kernel/commit/?h=openSUSE-13.1&id=d1f26676dad578a65c94782f0c2bd00b7aa68f1b
>
> "CVE-2014-4699 Kernel: x86_64,ptrace: Enforce RIP <= TASK_SIZE_MAX"
> https://bugzilla.redhat.com/show_bug.cgi?id=1115927

Some more:

"FS#41115 - [linux] [linux-lts] CVE-2014-4699 ptrace vulnerability"
https://bugs.archlinux.org/task/41115?project=1

"CVE-2014-4699"
https://security-tracker.debian.org/tracker/CVE-2014-4699

"KernelCare update for local privilege escalation CVE-2014-4699"
http://www.cloudlinux.com/blog/clnews/kernelcare-update-for-local-privilege-escalation-cve20144699.php

"CentOS 6, RHEL 6, CL 6 & OpenVZ can now be patched against
CVE-2014-4699. The patched kernels are yet to be available from the
vendors. Yet, due to the nature of the issue, we wanted to release the
patch as soon as possible"

Just tracking how quickly distros patch a critical issue for which
there's no published exploit yet.

Alexander