Linux Kernel 'perf_event_mmap()' Local Denial of Service Vulnerability

2010.11.25

Credit: Dave Jones

Risk: Low

Local: Yes

Remote: No

CVE: CVE-2010-4169

CWE: CWE-399

CVSS Base Score: 4.9/10

Impact Subscore: 6.9/10

Exploitability Subscore: 3.9/10

Exploit range: Local

Attack complexity: Low

Authentication: No required

Confidentiality impact: None

Integrity impact: None

Availability impact: Complete

Upstream commit dab5855 ("perf_counter: Add mmap event hooks to
mprotect()") is fundamentally wrong as mprotect_fixup() can free 'vma'
due to merging. Fix the problem by moving perf_event_mmap() hook to
mprotect_fixup(). In certain scenario, a local, unprivileged user could
use this flaw to trigger a denial of service.
Upstream commit:
http://git.kernel.org/linus/63bfd7384b119409685a17d5c58f0b56e5dc03da
https://bugzilla.redhat.com/show_bug.cgi?id=651671

References:

https://bugzilla.redhat.com/show_bug.cgi?id=651671

http://marc.info/?l=oss-security&m=128984344103497&w=2

http://marc.info/?l=oss-security&m=128979684911295&w=2

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=63bfd7384b119409685a17d5c58f0b56e5dc03da

http://xforce.iss.net/xforce/xfdb/63316

http://www.securityfocus.com/bid/44861

http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.37-rc2

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Linux Kernel 'perf_event_mmap()' Local Denial of Service Vulnerability

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.