From owner-freebsd-security@FreeBSD.ORG Sat Oct 25 22:03:54 2008 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 866C41065676 for ; Sat, 25 Oct 2008 22:03:54 +0000 (UTC) (envelope-from bz@FreeBSD.org) Received: from mail.cksoft.de (mail.cksoft.de [62.111.66.27]) by mx1.freebsd.org (Postfix) with ESMTP id 40A878FC17 for ; Sat, 25 Oct 2008 22:03:54 +0000 (UTC) (envelope-from bz@FreeBSD.org) Received: from localhost (amavis.str.cksoft.de [192.168.74.71]) by mail.cksoft.de (Postfix) with ESMTP id 3267041C69F for ; Sat, 25 Oct 2008 23:45:06 +0200 (CEST) X-Virus-Scanned: amavisd-new at cksoft.de Received: from mail.cksoft.de ([62.111.66.27]) by localhost (amavis.str.cksoft.de [192.168.74.71]) (amavisd-new, port 10024) with ESMTP id xvyFx6D7VeMO for ; Sat, 25 Oct 2008 23:45:05 +0200 (CEST) Received: by mail.cksoft.de (Postfix, from userid 66) id C03C141C67B; Sat, 25 Oct 2008 23:45:05 +0200 (CEST) Received: from maildrop.int.zabbadoz.net (maildrop.int.zabbadoz.net [10.111.66.10]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.int.zabbadoz.net (Postfix) with ESMTP id CFEDC44487F for ; Sat, 25 Oct 2008 21:43:38 +0000 (UTC) Date: Sat, 25 Oct 2008 21:43:32 +0000 (UTC) From: "Bjoern A. Zeeb" X-X-Sender: bz@maildrop.int.zabbadoz.net To: freebsd-security@freebsd.org Message-ID: <20081025211406.A2978@maildrop.int.zabbadoz.net> X-OpenPGP-Key: 0x14003F198FEFA3E77207EE8D2B58B8F83CCF1842 MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Mailman-Approved-At: Sat, 25 Oct 2008 22:05:46 +0000 Subject: CVE-2008-3831 / svn commit: r184263 - head/sys/dev/drm (fwd) X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Oct 2008 22:03:54 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, the commit referenced below fixes a problem arosen from an insufficient (missing) privilege check. If you are running a HEAD kernel from Aug 23 2008 (r182080) or later with drm/i915drm you want to update your kernel. The problem is only present in HEAD thus there will be no security advisory. Regards, Bjoern A. Zeeb FreeBSD Security Team - -- Bjoern A. Zeeb Stop bit received. Insert coin for new game. - ---------- Forwarded message ---------- Date: Sat, 25 Oct 2008 16:29:28 +0000 (UTC) From: Robert Noland To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r184263 - head/sys/dev/drm Author: rnoland Date: Sat Oct 25 16:29:28 2008 New Revision: 184263 URL: http://svn.freebsd.org/changeset/base/184263 Log: drm/i915: fix ioremap of a user address for non-root (CVE-2008-3831) Olaf Kirch noticed that the i915_set_status_page() function of the i915 kernel driver calls ioremap with an address offset that is supplied by userspace via ioctl. The function zeroes the mapped memory via memset and tells the hardware about the address. Turns out that access to that ioctl is not restricted to root so users could probably exploit that to do nasty things. We haven't tried to write actual exploit code though. It only affects the Intel G33 series and newer. Approved by: bz (secteam) Obtained from: Intel drm repo Security: CVE-2008-3831 Modified: head/sys/dev/drm/i915_dma.c Modified: head/sys/dev/drm/i915_dma.c ============================================================================== - --- head/sys/dev/drm/i915_dma.c Sat Oct 25 14:01:29 2008 (r184262) +++ head/sys/dev/drm/i915_dma.c Sat Oct 25 16:29:28 2008 (r184263) @@ -1228,7 +1228,7 @@ struct drm_ioctl_desc i915_ioctls[] = { DRM_IOCTL_DEF(DRM_I915_GET_VBLANK_PIPE, i915_vblank_pipe_get, DRM_AUTH ), DRM_IOCTL_DEF(DRM_I915_VBLANK_SWAP, i915_vblank_swap, DRM_AUTH), DRM_IOCTL_DEF(DRM_I915_MMIO, i915_mmio, DRM_AUTH), - - DRM_IOCTL_DEF(DRM_I915_HWS_ADDR, i915_set_status_page, DRM_AUTH), + DRM_IOCTL_DEF(DRM_I915_HWS_ADDR, i915_set_status_page, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY), #ifdef I915_HAVE_BUFFER DRM_IOCTL_DEF(DRM_I915_EXECBUFFER, i915_execbuffer, DRM_AUTH), #endif -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.2 (FreeBSD) iD8DBQFJA5MKK1i4+DzPGEIRAp0NAJ9cGyIwyTLp4hYvbwYMll7cROkmKQCghNvb sy2LhCFWcEzfad7oEP1qU4M= =RXrx -----END PGP SIGNATURE-----