Candidate: CVE-2007-3731
References: 
 MISC:http://bugzilla.kernel.org/show_bug.cgi?id=8765
 CONFIRM:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=29eb51101c02df517ca64ec472d7501127ad1da8
 CONFIRM:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=a10d9a71bafd3a283da240d2868e71346d2aef6f
 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=248324
Description: 
 The Linux kernel 2.6.20 and 2.6.21 does not properly handle an invalid LDT
 segment selector in %cs (the xcs field) during ptrace single-step operations,
 which allows local users to cause a denial of service (NULL dereference and
 OOPS) via certain code that makes ptrace PTRACE_SETREGS and PTRACE_SINGLESTEP
 requests, related to the TRACE_IRQS_ON function, and possibly related to the
 arch_ptrace function.
Ubuntu-Description: 
 Evan Teran discovered that the Linux kernel ptrace routines did not
 correctly handle certain requests robustly.  Local attackers could
 exploit this to crash the system, causing a denial of service.
Notes: 
 dannf> Note that the description is somewhat misleading - I can reproduce
        on 2.6.18, so its not limited to 2.6.20 and 2.6.21
 jmm> a10d9a71bafd3a283da240d2868e71346d2aef6f
 dannf> reproducer in http://bugzilla.kernel.org/show_bug.cgi?id=8765
Bugs: 
upstream: released (2.6.23-rc1)
linux-2.6: released (2.6.23-1)
2.6.18-etch-security: released (2.6.18.dfsg.1-13etch3) [bugfix/ptrace-handle-bogus-selector.patch, bugfix/fixup-trace_irq-breakage.patch]
2.6.8-sarge-security: N/A "cannot reproduce in 2.6.8, code is very different"
2.4.27-sarge-security: N/A "cannot reproduce in 2.4"
2.6.15-dapper-security: released (2.6.15-29.59)
2.6.17-edgy-security: released (2.6.17.1-12.41 17fc2937158a31e501e7e0aae9e3951b9ca49a0a, cd01b60fda15bb9d76eecf9420c989c3248881f6)
2.6.20-feisty-security: released (2.6.20-16.32 6227bc5e0cc5f5993c51f05f77d4602d5602b888, 2d7bfc148eece4514edf175b7e75d7fa48555fa2)