Linux Kernel 'perf_event_mmap()' Local Denial of Service Vulnerability

2010.11.25
Credit: Dave Jones
Risk: Low
Local: Yes
Remote: No
CWE: CWE-399


Ogólna skala CVSS: 4.9/10
Znaczenie: 6.9/10
Łatwość wykorzystania: 3.9/10
Wymagany dostęp: Lokalny
Złożoność ataku: Niska
Autoryzacja: Nie wymagana
Wpływ na poufność: Brak
Wpływ na integralność: Brak
Wpływ na dostępność: Pełny

Upstream commit dab5855 ("perf_counter: Add mmap event hooks to mprotect()") is fundamentally wrong as mprotect_fixup() can free 'vma' due to merging. Fix the problem by moving perf_event_mmap() hook to mprotect_fixup(). In certain scenario, a local, unprivileged user could use this flaw to trigger a denial of service. Upstream commit: http://git.kernel.org/linus/63bfd7384b119409685a17d5c58f0b56e5dc03da https://bugzilla.redhat.com/show_bug.cgi?id=651671

Referencje:

https://bugzilla.redhat.com/show_bug.cgi?id=651671
http://marc.info/?l=oss-security&m=128984344103497&w=2
http://marc.info/?l=oss-security&m=128979684911295&w=2
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=63bfd7384b119409685a17d5c58f0b56e5dc03da
http://xforce.iss.net/xforce/xfdb/63316
http://www.securityfocus.com/bid/44861
http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.37-rc2


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top