blob: 4116085a7dc38f8f2803e0b820d333852f4214d8 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
|
Candidate: CVE-2006-2445
References:
http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8f17fc20bfb75bcec4cfeda789738979c8338fdc
http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=30f1e3dd8c72abda343bcf415f7d8894a02b4290
http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f53ae1dc3429529a58aa538e0a860d713c7079c3
http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ca531a0a5e01e5122f67cb6aca8fcbfc70e18e0b
Description:
Race condition in run_posix_cpu_timers in Linux kernel before 2.6.16.21
allows local users to cause a denial of service (BUG_ON crash) by causing one
CPU to attach a timer to a process that is exiting.
Notes:
jmm> Only exploitable on SMP systems
jmm> 2.6.8 most probably not affected, but there was a reproducer posted to vendor-sec, should be double-checked
jmm> Vulnerable code not present in 2.4
dannf> 2.6.8 didn't have posix-cpu-timers
mpitt> 2.6.10-hoary does not need 4th GIT patch, function does not exist
Bugs:
upstream: released (2.6.16.21)
linux-2.6: released (2.6.16-15)
2.6.8-sarge-security: N/A
2.4.27-sarge-security: N/A
2.6.10-hoary-security: released (2.6.10-34.21) [GIT patches 1 to 3]
2.6.12-breezy-security: released (2.6.12-10.35) [GIT patches 1 to 3], needed [GIT patch 4]
2.6.15-dapper-security: released (2.6.15-26.44) [GIT patches 1 to 3], needed [GIT patch 4]
2.6.17-edgy: released
|
