Linux ptrace bug (CVE-2014-4699)

[Pavel Chekin]

The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls.

[Alexei Sheplyakov (asheplyakov)]

The issue has been fixed in upstream version 3.10.48 (to be more specific, commit 8c6fa0a671dc12ee3dd658dafbd1d4a7fec2250d "`ptrace,x86: force IRET path after a ptrace_stop()').

Ubuntu team has released a fix for 2.6.32 (see https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1337339, http://archive.ubuntu.com/ubuntu/pool/main/l/linux/linux_2.6.32-64.127.diff.gz), but there's no official update for CentOS 6.5/RHEL 6.
Should we wait for one, or we can peek the fix from Ubuntu (which is basically equivalent to commit 8c6fa0a671dc12ee3dd658dafbd1d4a7fec2250d )?

[Alexei Sheplyakov (asheplyakov)]

Red Hat has released a kernel update, see https://rhn.redhat.com/errata/RHSA-2014-0924.html

[Alexei Sheplyakov (asheplyakov)]

Addressed by https://review.fuel-infra.org/gitweb?p=packages/centos6/kernel.git;a=commit;h=b14054745b66fafa48d6b95ae1feb054a838ca68 (CentOS),
Ubuntu kernels are not affected (the ones newer than 3.11.0-26.44 and 3.13.0-32)