net: pppol2tp: level handling in pppol2tp_[s,g]etsockopt()
CVE: CVE-2014-4943
Component: kernel
Severity: Important
Release date: 2014-07-16T00:00:00+00:00

A flaw was found in the way the pppol2tp_setsockopt() and pppol2tp_getsockopt() functions in the Linux kernel's PPP over L2TP implementation handled requests with a non-SOL_PPPOL2TP socket option level. A local, unprivileged user could use this flaw to escalate their privileges on the system.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat
Enterprise Linux 5 and Red Hat Enterprise MRG 2.

Please note that on Red Hat Enterprise Linux 6 pppol2tp module is not
automatically loaded when AF_PPPOX/PX_PROTO_OL2TP socket is created as
Red Hat Enterprise Linux 6 lacks upstream commit 9395a09d05a23bb and default
modprobe configuration as shipped with module-init-tools package does not
contain the alias for pppol2tp protocol either. As a result, pppol2tp module
has to be explicitly enabled and/or loaded by the system administrator.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

To install kernel packages manually, use "rpm -ivh [package]". Do not use
"rpm -Uvh" as that will remove the running kernel binaries from your
system. You may use "rpm -e" to remove old kernels after determining that
the new kernel functions properly on your system.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

To install kernel packages manually, use "rpm -ivh [package]". Do not use
"rpm -Uvh" as that will remove the running kernel binaries from your
system. You may use "rpm -e" to remove old kernels after determining that
the new kernel functions properly on your system.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

To install kernel packages manually, use "rpm -ivh [package]". Do not use
"rpm -Uvh" as that will remove the running kernel binaries from your
system. You may use "rpm -e" to remove old kernels after determining that
the new kernel functions properly on your system.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

To install kernel packages manually, use "rpm -ivh [package]". Do not use
"rpm -Uvh" as that will remove the running kernel binaries from your
system. You may use "rpm -e" to remove old kernels after determining that
the new kernel functions properly on your system.
For Red Hat Enterprise Linux 6 do --

]# echo "install pppol2tp /bin/true" > /etc/modprobe.d/pppol2tp.conf

For Red Hat Enterprise Linux 7 do --

]# echo "install l2tp_ppp /bin/true" > /etc/modprobe.d/l2t_pppp.conf

Or, alternatively, when pppol2tp/l2tp_ppp module can't be blacklisted and needs
to be loaded, you can use the following systemtap script --

1) On the host, save the following in a file with the ".stp" extension --

probe module("*l2tp*").function("pppol2tp_*etsockopt").call {
        $level = 273;
}

2) Install the "systemtap" package and any required dependencies. Refer to
the "2. Using SystemTap" chapter in the Red Hat Enterprise Linux 6
"SystemTap Beginners Guide" document, available from docs.redhat.com, for
information on installing the required -debuginfo packages.

3) Run the "stap -g [filename-from-step-1].stp" command as root.

If the host is rebooted, the changes will be lost and the script must be
run again.

Alternatively, build the systemtap script on a development system with
"stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel
module to all affected systems, and run "staprun -L <module>" on those.
When using this approach only systemtap-runtime package is required on the
affected systems. Please notice that the kernel version must be the same across
all systems.