Ubuntu
linux package

TOMOYO bugfix patches

Bug #830298 reported by Tetsuo Handa on 2011-08-20

This bug report is a duplicate of: Bug #922377: CVE-2011-2518. Edit Remove

This bug affects 1 person

	Status	Importance	Assigned to
linux (Ubuntu)	Fix Released	Medium	Unassigned
Lucid	Triaged	Undecided	Unassigned
Maverick	Invalid	Undecided	Unassigned
Natty	Invalid	Undecided	Unassigned

Bug Description

Please consider applying below bugfix patches.
All patches are already in upstream Linux 3.0 kernel.

For Ubuntu 10.04 LTS kernel:
[PATCH] TOMOYO: Fix race on updating profile's comment line.
(commit 2a086e5d3a23570735f75b784d29b93068070833 upstream.)
http://tomoyo.sourceforge.jp/2.2/patches/2.6.32-tomoyo-fix-race-on-updating-profile-comment.patch

For Ubuntu 10.10 kernel:
http://tomoyo.sourceforge.jp/2.2/patches/2.6.35-tomoyo-fix-memory-leak-in-tomoyo_commit_ok.patch
(commit cfc64fd91fabed099a4c3df58559f4b7efe9bcce upstream.)
http://tomoyo.sourceforge.jp/2.2/patches/2.6.35-tomoyo-fix-race-on-updating-profile-comment.patch
(commit 2a086e5d3a23570735f75b784d29b93068070833 upstream.)

For Ubuntu 11.04 kernel:
http://tomoyo.sourceforge.jp/2.3/patches/2.6.38-tomoyo-dont-add-trailing-slash-for-allow_unmount-check.patch
(commit e4f5f26d8336318a5aa0858223c81cf29fcf5f68 upstream.)
http://tomoyo.sourceforge.jp/2.3/patches/2.6.38-tomoyo-fix-domainname-validation-in-tomoyo_correct_domain.patch
(commit e77dc3460fa59be5759e9327ad882868eee9d61b upstream.)
http://tomoyo.sourceforge.jp/2.3/patches/2.6.38-tomoyo-fix-infinite-loop-bug-when-reading-sys-kernel-security-tomoyo-query.patch
(commit c0fa797ae6cd02ff87c0bfe0d509368a3b45640e upstream.)
http://tomoyo.sourceforge.jp/2.3/patches/2.6.38-tomoyo-fix-memory-leak-in-tomoyo_commit_ok.patch
(commit cfc64fd91fabed099a4c3df58559f4b7efe9bcce upstream.)
http://tomoyo.sourceforge.jp/2.3/patches/2.6.38-tomoyo-fix-oops-in-tomoyo_mount_acl.patch
(commit 4e78c724d47e2342aa8fde61f6b8536f662f795f upstream.) (CVE-2011-2518)
http://tomoyo.sourceforge.jp/2.3/patches/2.6.38-tomoyo-fix-race-on-updating-profile-comment.patch
(commit 2a086e5d3a23570735f75b784d29b93068070833 upstream.)
http://tomoyo.sourceforge.jp/2.3/patches/2.6.38-tomoyo-fix-refcount-leak-in-tomoyo_mount_acl.patch
(commit db5ca356d8af8e43832c185ceec90850ff2ebb45 upstream.)

Revision history for this message

Brad Figg (brad-figg) wrote on 2011-08-21: Missing required logs.

This bug is missing log files that will aid in diagnosing the problem. From a terminal window please run:

apport-collect 830298

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu):
status:	New → Incomplete

Revision history for this message

Tetsuo Handa (9-launchpad-i-love-sakura-ne-jp) wrote on 2011-08-22:

Download full text (3.9 KiB)

"apport-collect 830298" didn't work.

root@ubuntu:~# apport-collect 830298
ERROR: connecting to Launchpad failed: 'NoneType' object has no attribute 'makefile'
You can reset the credentials by removing the file "/root/.cache/apport/launchpad.credentials"

Below output shows that patch for CVE-2011-2518 is not yet applied as of
2.6.38-11.48.

root@ubuntu:~# cat /proc/version
Linux version 2.6.38-11-generic-pae (buildd@rothera) (gcc version 4.5.2 (Ubuntu/Linaro 4.5.2-8ubuntu4) ) #48-Ubuntu SMP Fri Jul 29 20:51:21 UTC 2011
root@ubuntu:~# dmesg
[ 527.236229] BUG: unable to handle kernel NULL pointer dereference at (null)
[ 527.255068] IP: [<c113c6f3>] path_init_rcu+0x33/0x220
[ 527.255986] *pdpt = 000000003692d001 *pde = 0000000000000000
[ 527.256810] Oops: 0000 [#1] SMP
[ 527.257704] last sysfs file: /sys/devices/system/cpu/cpu3/cache/index2/shared_cpu_map
[ 527.259646] Modules linked in: e1000 vesafb ppdev vmw_balloon snd_ens1371 gameport psmouse serio_raw snd_rawmidi snd_seq_device snd_ac97_codec ac97_bus snd_pcm snd_timer parport_pc snd soundcore snd_page_alloc shpchp i2c_piix4 lp parport floppy pcnet32 mptspi mptscsih mptbase
[ 527.288587]
[ 527.289881] Pid: 1884, comm: a.out Not tainted 2.6.38-11-generic-pae #48-Ubuntu VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform
[ 527.292996] EIP: 0060:[<c113c6f3>] EFLAGS: 00010206 CPU: 2
[ 527.294817] EIP is at path_init_rcu+0x33/0x220
[ 527.334267] EAX: ffffff9c EBX: f69e1e28 ECX: 00000041 EDX: 00000000
[ 527.335996] ESI: f3dc82b0 EDI: 00000000 EBP: f69e1dfc ESP: f69e1de8
[ 527.337717] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[ 527.339528] Process a.out (pid: 1884, ti=f69e0000 task=f3eff1a0 task.ti=f69e0000)
[ 527.343186] Stack:
[ 527.345001] c16d0a50 00000000 f69e1e28 f3dc82b0 00000000 f69e1e1c c113eb91 f69e1e28
[ 527.348842] ffffff9c 00000001 f69e1ed4 f3dc82b0 f69e1f04 f69e1e90 c113ecb2 f69e1e28
[ 527.390961] 00000010 00008050 f3dc82b0 00000004 f6d333c8 00000000 c114b204 00000000
[ 527.390973] Call Trace:
[ 527.391002] [<c113eb91>] do_path_lookup+0x21/0x120
[ 527.391009] [<c113ecb2>] kern_path+0x22/0x40
[ 527.391019] [<c114b204>] ? find_filesystem+0x44/0x50
[ 527.391026] [<c114b3e3>] ? get_fs_type+0x33/0xb0
[ 527.391059] [<c124f7b8>] ? tomoyo_fill_path_info+0x18/0xe0
[ 527.391068] [<c124df8c>] tomoyo_mount_acl+0x1bc/0x240
[ 527.391075] [<c113c829>] ? path_init_rcu+0x169/0x220
[ 527.391083] [<c124e16d>] tomoyo_mount_permission+0xdd/0x110
[ 527.391091] [<c124ea0e>] tomoyo_sb_mount+0x1e/0x30
[ 527.391106] [<c1227022>] security_sb_mount+0x22/0x30
[ 527.391115] [<c114e1fd>] do_mount+0x9d/0x1e0
[ 527.391123] [<c114e6ab>] sys_mount+0x6b/0xa0
[ 527.391248] [<c100ab5f>] sysenter_do_call+0x12/0x28
[ 527.391255] Code: 08 3e 8d 74 26 00 8b 5d 08 83 c9 40 c7 43 2c 01 00 00 00 89 4b 24 c7 43 30 00 00 00 00 c7 43 14 00 00 00 00 c7 43 1c 00 00 00 00 <80> 3a 2f 0f 84 1c 01 00 00 83 f8 9c 74 47 8d 55 f0 bf f7 ff ff
[ 527.391301] EIP: [<c113c6f3>] path_init_rcu+0x33/0x220 SS:ESP 0068:f69e1de8
[ 527.391311] CR2: 0000000000000000
[ 527.391468] ---[ end trace d8948656a5d83a06 ]---

--- Source code for a.out ---
#include <sys/mount.h>
#inclu...

"apport-collect 830298" didn't work.

Below output shows that patch for CVE-2011-2518 is not yet applied as of
2.6.38-11.48.

root@ubuntu:~# cat /proc/version
Linux version 2.6.38-11-generic-pae (buildd@rothera) (gcc version 4.5.2 (Ubuntu/Linaro 4.5.2-8ubuntu4) ) #48-Ubuntu SMP Fri Jul 29 20:51:21 UTC 2011
root@ubuntu:~# dmesg
[  527.236229] BUG: unable to handle kernel NULL pointer dereference at   (null)
[  527.255068] IP: [<c113c6f3>] path_init_rcu+0x33/0x220
[  527.255986] *pdpt = 000000003692d001 *pde = 0000000000000000
[  527.256810] Oops: 0000 [#1] SMP
[  527.257704] last sysfs file: /sys/devices/system/cpu/cpu3/cache/index2/shared_cpu_map
[  527.259646] Modules linked in: e1000 vesafb ppdev vmw_balloon snd_ens1371 gameport psmouse serio_raw snd_rawmidi snd_seq_device snd_ac97_codec ac97_bus snd_pcm snd_timer parport_pc snd soundcore snd_page_alloc shpchp i2c_piix4 lp parport floppy pcnet32 mptspi mptscsih mptbase
[  527.288587]
[  527.289881] Pid: 1884, comm: a.out Not tainted 2.6.38-11-generic-pae #48-Ubuntu VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform
[  527.292996] EIP: 0060:[<c113c6f3>] EFLAGS: 00010206 CPU: 2
[  527.294817] EIP is at path_init_rcu+0x33/0x220
[  527.334267] EAX: ffffff9c EBX: f69e1e28 ECX: 00000041 EDX: 00000000
[  527.335996] ESI: f3dc82b0 EDI: 00000000 EBP: f69e1dfc ESP: f69e1de8
[  527.337717]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[  527.339528] Process a.out (pid: 1884, ti=f69e0000 task=f3eff1a0 task.ti=f69e0000)
[  527.343186] Stack:
[  527.345001]  c16d0a50 00000000 f69e1e28 f3dc82b0 00000000 f69e1e1c c113eb91 f69e1e28
[  527.348842]  ffffff9c 00000001 f69e1ed4 f3dc82b0 f69e1f04 f69e1e90 c113ecb2 f69e1e28
[  527.390961]  00000010 00008050 f3dc82b0 00000004 f6d333c8 00000000 c114b204 00000000
[  527.390973] Call Trace:
[  527.391002]  [<c113eb91>] do_path_lookup+0x21/0x120
[  527.391009]  [<c113ecb2>] kern_path+0x22/0x40
[  527.391019]  [<c114b204>] ? find_filesystem+0x44/0x50
[  527.391026]  [<c114b3e3>] ? get_fs_type+0x33/0xb0
[  527.391059]  [<c124f7b8>] ? tomoyo_fill_path_info+0x18/0xe0
[  527.391068]  [<c124df8c>] tomoyo_mount_acl+0x1bc/0x240
[  527.391075]  [<c113c829>] ? path_init_rcu+0x169/0x220
[  527.391083]  [<c124e16d>] tomoyo_mount_permission+0xdd/0x110
[  527.391091]  [<c124ea0e>] tomoyo_sb_mount+0x1e/0x30
[  527.391106]  [<c1227022>] security_sb_mount+0x22/0x30
[  527.391115]  [<c114e1fd>] do_mount+0x9d/0x1e0
[  527.391123]  [<c114e6ab>] sys_mount+0x6b/0xa0
[  527.391248]  [<c100ab5f>] sysenter_do_call+0x12/0x28
[  527.391255] Code: 08 3e 8d 74 26 00 8b 5d 08 83 c9 40 c7 43 2c 01 00 00 00 89 4b 24 c7 43 30 00 00 00 00 c7 43 14 00 00 00 00 c7 43 1c 00 00 00 00 <80> 3a 2f 0f 84 1c 01 00 00 83 f8 9c 74 47 8d 55 f0 bf f7 ff ff
[  527.391301] EIP: [<c113c6f3>] path_init_rcu+0x33/0x220 SS:ESP 0068:f69e1de8
[  527.391311] CR2: 0000000000000000
[  527.391468] ---[ end trace d8948656a5d83a06 ]---

--- Source code for a.out ---
#include <sys/mount.h>
#include <unistd.h>

int main(int argc, char *argv[])
{
        mount(NULL, NULL, NULL, 0, NULL);
        mount(NULL, NULL, "ext3", 0, NULL);
        mount(NULL, "/", NULL, 0, NULL);
        mount(NULL, "/", "ext3", 0, NULL);
        mount("/", NULL, NULL, 0, NULL);
        mount("/", NULL, "ext3", 0, NULL);
        mount("/", "/", NULL, 0, NULL);
        mount("/", "/", "ext3", 0, NULL);
        mount(NULL, NULL, NULL, 0, NULL);
        mount(NULL, NULL, "tmpfs", 0, NULL);
        mount(NULL, "/", NULL, 0, NULL);
        mount(NULL, "/", "tmpfs", 0, NULL);
        mount("/", NULL, NULL, 0, NULL);
        mount("/", NULL, "tmpfs", 0, NULL);
        mount("/", "/", NULL, 0, NULL);
        mount("/", "/", "tmpfs", 0, NULL);
        return 0;
}
---

Regards.

Changed in linux (Ubuntu):
status:	Incomplete → Confirmed

Leann Ogasawara (leannogasawara) on 2011-08-22

Changed in linux (Ubuntu):
importance:	Undecided → Medium
status:	Confirmed → Triaged

Andy Whitcroft (apw) on 2011-08-22

Changed in linux (Ubuntu):
status:	Triaged → Fix Released
Changed in linux (Ubuntu Lucid):
status:	New → Triaged
Changed in linux (Ubuntu Maverick):
status:	New → Triaged
Changed in linux (Ubuntu Natty):
status:	New → Triaged