CVE-2014-0196: kernel memory corruption via a race in pty write handling

This document (7015061) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 11 Service Pack 3 (SLES 11 SP3)

Situation

This is a critical security issue reported as VUL-0: CVE-2014-0196. That is a race condition in pty (pseudo terminal) write buffer handling that can be used by local attackers to corrupt kernel memory and so cause a system crash or potentially code execution.

Resolution

The fixes for both issues are available and have been published. Update the kernel to the current version, or at least to 3.0.101-0.29.1 by using the usual update channels.

Cause

Engineering (Jiri) does think that the issue has been introduced by a rework of the pty layer to use the normal buffering logic in 2.6.31-rc3 (d945cb9cce20ac7143c2de8d88b187f62db99bdc). Until then the pty was writing directly to a line discipline without using buffers.

Additional Information

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.