Linux Kernel World Writable SYSFS DRM Debug File Vulnerability

Bugtraq ID:	15154
Class:	Design Error
CVE:	CVE-2005-3179
Remote:	No
Local:	Yes
Published:	Oct 20 2005 12:00AM
Updated:	May 29 2006 08:53PM
Credit:	Discovery credited to alwin.
Vulnerable:	Redhat Fedora Core3 Mandriva Linux Mandrake 2006.0 x86_64 Mandriva Linux Mandrake 2006.0 Mandriva Linux Mandrake 10.2 x86_64 Mandriva Linux Mandrake 10.2 Linux kernel 2.6.13 -rc7 Linux kernel 2.6.13 -rc6 Linux kernel 2.6.13 -rc4 Linux kernel 2.6.13 -rc1 Linux kernel 2.6.13 Linux kernel 2.6.12 .5 Linux kernel 2.6.12 .4 Linux kernel 2.6.12 .3 Linux kernel 2.6.12 .2 Linux kernel 2.6.12 .1 Linux kernel 2.6.12 -rc5 Linux kernel 2.6.12 -rc4 Linux kernel 2.6.12 -rc1 Linux kernel 2.6.11 .8 Linux kernel 2.6.11 .7 Linux kernel 2.6.11 .6 Linux kernel 2.6.11 .5 Linux kernel 2.6.11 .11 Linux kernel 2.6.11 -rc4 Linux kernel 2.6.11 -rc3 Linux kernel 2.6.11 -rc2 Linux kernel 2.6.11 + Redhat Fedora Core4 Linux kernel 2.6.10 rc2 Linux kernel 2.6.10 + Redhat Fedora Core3 + Redhat Fedora Core2 + Trustix Secure Linux 3.0 + Ubuntu Ubuntu Linux 5.0 4 powerpc + Ubuntu Ubuntu Linux 5.0 4 i386 + Ubuntu Ubuntu Linux 5.0 4 amd64
Not Vulnerable:	Linux kernel 2.6.13 .4

Linux Kernel World Writable SYSFS DRM Debug File Vulnerability

Linux kernel is prone to an issue where a world writable file is created in SYSFS. Exploitation could allow an attacker to obtain sensitive information.

Linux Kernel World Writable SYSFS DRM Debug File Vulnerability

An exploit is not required.

Linux Kernel World Writable SYSFS DRM Debug File Vulnerability

Solution:
This issue has been addressed in version 2.6.13.4 of the Linux kernel.

Please see the referenced advisories for further information.


Linux kernel 2.6.10

• Linux linux-2.6.13.4.tar.bz2
  http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.4.tar.bz2

Linux kernel 2.6.10 rc2

• Linux linux-2.6.13.4.tar.bz2
  http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.4.tar.bz2

Linux kernel 2.6.11 -rc3

• Linux linux-2.6.13.4.tar.bz2
  http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.4.tar.bz2

Linux kernel 2.6.11

• Linux linux-2.6.13.4.tar.bz2
  http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.4.tar.bz2


• Mandriva kernel-2.6.11.13mdk-1-1mdk.i586.rpm
  Mandriva Linux 10.2:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva kernel-2.6.11.13mdk-1-1mdk.x86_64.rpm
  Mandriva Linux 10.2/X86_64:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva kernel-i586-up-1GB-2.6.11.13mdk-1-1mdk.i586.rpm
  Mandriva Linux 10.2:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva kernel-i686-up-4GB-2.6.11.13mdk-1-1mdk.i586.rpm
  Mandriva Linux 10.2:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva kernel-smp-2.6.11.13mdk-1-1mdk.i586.rpm
  Mandriva Linux 10.2:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva kernel-smp-2.6.11.13mdk-1-1mdk.x86_64.rpm
  Mandriva Linux 10.2/X86_64:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva kernel-source-2.6-2.6.11-13mdk.i586.rpm
  Mandriva Linux 10.2:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva kernel-source-2.6-2.6.11-13mdk.x86_64.rpm
  Mandriva Linux 10.2/X86_64:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva kernel-source-stripped-2.6-2.6.11-13mdk.i586.rpm
  Mandriva Linux 10.2:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva kernel-source-stripped-2.6-2.6.11-13mdk.x86_64.rpm
  Mandriva Linux 10.2/X86_64:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva kernel-xbox-2.6.11.13mdk-1-1mdk.i586.rpm
  Mandriva Linux 10.2:
  http://www1.mandrivalinux.com/en/ftp.php3

Linux kernel 2.6.11 -rc2

• Linux linux-2.6.13.4.tar.bz2
  http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.4.tar.bz2

Linux kernel 2.6.11 .7

• Linux linux-2.6.13.4.tar.bz2
  http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.4.tar.bz2

Linux kernel 2.6.11 -rc4

• Linux linux-2.6.13.4.tar.bz2
  http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.4.tar.bz2

Linux kernel 2.6.11 .6

• Linux linux-2.6.13.4.tar.bz2
  http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.4.tar.bz2

Linux kernel 2.6.11 .11

• Linux linux-2.6.13.4.tar.bz2
  http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.4.tar.bz2

Linux kernel 2.6.11 .5

• Linux linux-2.6.13.4.tar.bz2
  http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.4.tar.bz2

Linux kernel 2.6.11 .8

• Linux linux-2.6.13.4.tar.bz2
  http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.4.tar.bz2

Linux kernel 2.6.12 .2

• Linux linux-2.6.13.4.tar.bz2
  http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.4.tar.bz2

Linux kernel 2.6.12 .5

• Linux linux-2.6.13.4.tar.bz2
  http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.4.tar.bz2

Linux kernel 2.6.12 -rc4

• Linux linux-2.6.13.4.tar.bz2
  http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.4.tar.bz2

Linux kernel 2.6.12 .4

• Linux linux-2.6.13.4.tar.bz2
  http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.4.tar.bz2

Linux kernel 2.6.12 .3

• Linux linux-2.6.13.4.tar.bz2
  http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.4.tar.bz2

Linux kernel 2.6.12 .1

• Linux linux-2.6.13.4.tar.bz2
  http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.4.tar.bz2

Linux kernel 2.6.12 -rc5

• Linux linux-2.6.13.4.tar.bz2
  http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.4.tar.bz2

Linux kernel 2.6.12 -rc1

• Linux linux-2.6.13.4.tar.bz2
  http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.4.tar.bz2


• Mandriva kernel-2.6.12.14mdk-1-1mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva kernel-2.6.12.14mdk-1-1mdk.x86_64.rpm
  Mandriva Linux 2006.0/X86_64:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva kernel-i586-up-1GB-2.6.12.14mdk-1-1mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva kernel-i686-up-4GB-2.6.12.14mdk-1-1mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva kernel-smp-2.6.12.14mdk-1-1mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva kernel-smp-2.6.12.14mdk-1-1mdk.x86_64.rpm
  Mandriva Linux 2006.0/X86_64:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva kernel-source-2.6-2.6.12-14mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva kernel-source-2.6-2.6.12-14mdk.x86_64.rpm
  Mandriva Linux 2006.0/X86_64:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva kernel-source-stripped-2.6-2.6.12-14mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva kernel-source-stripped-2.6-2.6.12-14mdk.x86_64.rpm
  Mandriva Linux 2006.0/X86_64:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva kernel-xbox-2.6.12.14mdk-1-1mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva kernel-xen0-2.6.12.14mdk-1-1mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva kernel-xenU-2.6.12.14mdk-1-1mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads/

Linux kernel 2.6.13 -rc1

• Linux linux-2.6.13.4.tar.bz2
  http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.4.tar.bz2

Linux kernel 2.6.13 -rc4

• Linux linux-2.6.13.4.tar.bz2
  http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.4.tar.bz2

Linux kernel 2.6.13

• Linux linux-2.6.13.4.tar.bz2
  http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.4.tar.bz2

Linux kernel 2.6.13 -rc7

• Linux linux-2.6.13.4.tar.bz2
  http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.4.tar.bz2

Linux kernel 2.6.13 -rc6

• Linux linux-2.6.13.4.tar.bz2
  http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.4.tar.bz2

Linux Kernel World Writable SYSFS DRM Debug File Vulnerability

References:

• Bugzilla Bug 107893 (Gentoo)
  
• changeset: [PATCH] Fix drm 'debug' sysfs permissions (kernel.org)