From b5dff88447542aeaeb052e46ac5a81f56b13b47b Mon Sep 17 00:00:00 2001 From: dann frazier Date: Tue, 26 Sep 2006 05:25:01 +0000 Subject: retire all issues that have been fixed upstream and in all listed kernels that are affected git-svn-id: svn+ssh://svn.debian.org/svn/kernel-sec@600 e094ebfe-e918-0410-adfb-c712417f3574 --- retired/CVE-2006-2445 | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 retired/CVE-2006-2445 (limited to 'retired/CVE-2006-2445') diff --git a/retired/CVE-2006-2445 b/retired/CVE-2006-2445 new file mode 100644 index 00000000..4116085a --- /dev/null +++ b/retired/CVE-2006-2445 @@ -0,0 +1,25 @@ +Candidate: CVE-2006-2445 +References: + http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8f17fc20bfb75bcec4cfeda789738979c8338fdc + http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=30f1e3dd8c72abda343bcf415f7d8894a02b4290 + http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f53ae1dc3429529a58aa538e0a860d713c7079c3 + http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ca531a0a5e01e5122f67cb6aca8fcbfc70e18e0b +Description: + Race condition in run_posix_cpu_timers in Linux kernel before 2.6.16.21 + allows local users to cause a denial of service (BUG_ON crash) by causing one + CPU to attach a timer to a process that is exiting. +Notes: + jmm> Only exploitable on SMP systems + jmm> 2.6.8 most probably not affected, but there was a reproducer posted to vendor-sec, should be double-checked + jmm> Vulnerable code not present in 2.4 + dannf> 2.6.8 didn't have posix-cpu-timers + mpitt> 2.6.10-hoary does not need 4th GIT patch, function does not exist +Bugs: +upstream: released (2.6.16.21) +linux-2.6: released (2.6.16-15) +2.6.8-sarge-security: N/A +2.4.27-sarge-security: N/A +2.6.10-hoary-security: released (2.6.10-34.21) [GIT patches 1 to 3] +2.6.12-breezy-security: released (2.6.12-10.35) [GIT patches 1 to 3], needed [GIT patch 4] +2.6.15-dapper-security: released (2.6.15-26.44) [GIT patches 1 to 3], needed [GIT patch 4] +2.6.17-edgy: released -- cgit v1.2.3