Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ "ΠΈΡΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°Π½ΠΈΡ ΠΏΠΎΡΠ»Π΅ ΠΎΡΠ²ΠΎΠ±ΠΎΠΆΠ΄Π΅Π½ΠΈΡ" (use-after-free) Π² ΡΠ΄ΡΠ΅ Linux, ΠΏΠΎΠ·Π²ΠΎΠ»ΡΡΡΠ°Ρ Π²ΡΠ·Π²Π°ΡΡ ΠΎΡΠΊΠ°Π· Π² ΠΎΠ±ΡΠ»ΡΠΆΠΈΠ²Π°Π½ΠΈΠΈ (DoS) ΠΈΠ»ΠΈ ΠΏΠΎΠ²ΡΡΠΈΡΡ ΠΏΡΠ°Π²Π° Π΄ΠΎΡΡΡΠΏΠ° ΡΠ΅ΡΠ΅Π· Π²Π·Π°ΠΈΠΌΠΎΠ΄Π΅ΠΉΡΡΠ²ΠΈΠ΅ Ρ ΡΠ°ΠΉΠ»ΠΎΠ²ΠΎΠΉ ΡΠΈΡΡΠ΅ΠΌΠΎΠΉ hugetlbfs
ΠΠΏΠΈΡΠ°Π½ΠΈΠ΅
ΠΠ±Π½Π°ΡΡΠΆΠ΅Π½Π° ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΡ ΡΠΈΠΏΠ° "ΠΈΡΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°Π½ΠΈΠ΅ ΠΏΠΎΡΠ»Π΅ ΠΎΡΠ²ΠΎΠ±ΠΎΠΆΠ΄Π΅Π½ΠΈΡ" (use-after-free) Π² ΡΠ΄ΡΠ΅ Linux Π΄ΠΎ Π²Π΅ΡΡΠΈΠΈ 3.3.6 ΠΏΡΠΈ Π²ΠΊΠ»ΡΡΡΠ½Π½ΡΡ
ΠΎΠ³ΡΠΎΠΌΠ½ΡΡ
ΡΡΡΠ°Π½ΠΈΡΠ°Ρ
(huge pages). ΠΠΎΠΊΠ°Π»ΡΠ½ΡΠ΅ ΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°ΡΠ΅Π»ΠΈ ΠΌΠΎΠ³ΡΡ Π²ΡΠ·Π²Π°ΡΡ ΠΎΡΠΊΠ°Π· Π² ΠΎΠ±ΡΠ»ΡΠΆΠΈΠ²Π°Π½ΠΈΠΈ (Π°Π²Π°ΡΠΈΠΉΠ½ΠΎΠ΅ Π·Π°Π²Π΅ΡΡΠ΅Π½ΠΈΠ΅ ΡΠ°Π±ΠΎΡΡ ΡΠΈΡΡΠ΅ΠΌΡ) ΠΈΠ»ΠΈ, Π²ΠΎΠ·ΠΌΠΎΠΆΠ½ΠΎ, ΠΏΠΎΠ²ΡΡΠΈΡΡ ΠΏΡΠΈΠ²ΠΈΠ»Π΅Π³ΠΈΠΈ ΠΏΡΡΡΠΌ Π²Π·Π°ΠΈΠΌΠΎΠ΄Π΅ΠΉΡΡΠ²ΠΈΡ Ρ ΡΠ°ΠΉΠ»ΠΎΠ²ΠΎΠΉ ΡΠΈΡΡΠ΅ΠΌΠΎΠΉ hugetlbfs. ΠΡΠΎΠ±Π»Π΅ΠΌΠ° ΠΌΠΎΠΆΠ΅Ρ Π±ΡΡΡ ΠΏΡΠΎΠ΄Π΅ΠΌΠΎΠ½ΡΡΡΠΈΡΠΎΠ²Π°Π½Π° ΠΎΠΏΠ΅ΡΠ°ΡΠΈΠ΅ΠΉ umount, ΠΊΠΎΡΠΎΡΠ°Ρ ΠΈΠ½ΠΈΡΠΈΠΈΡΡΠ΅Ρ Π½Π΅ΠΏΡΠ°Π²ΠΈΠ»ΡΠ½ΡΡ ΠΎΠ±ΡΠ°Π±ΠΎΡΠΊΡ Π΄Π°Π½Π½ΡΡ
ΠΊΠ²ΠΎΡ.
ΠΠ°ΡΠ²Π»Π΅Π½ΠΈΠ΅
ΠΠ°Π½Π½Π°Ρ ΠΏΡΠΎΠ±Π»Π΅ΠΌΠ° Π½Π΅ Π·Π°ΡΡΠ°Π³ΠΈΠ²Π°Π΅Ρ Π²Π΅ΡΡΠΈΠΈ ΡΠ΄ΡΠ° Linux, ΠΏΠΎΡΡΠ°Π²Π»ΡΠ΅ΠΌΡΠ΅ Ρ Red Hat Enterprise Linux 5. ΠΡΠ΄ΡΡΠΈΠ΅ ΠΎΠ±Π½ΠΎΠ²Π»Π΅Π½ΠΈΡ ΡΠ΄ΡΠ° Π΄Π»Ρ Red Hat Enterprise Linux 6 ΠΈ Red Hat Enterprise Linux MRG 2 ΠΌΠΎΠ³ΡΡ ΡΡΡΡΠ°Π½ΠΈΡΡ ΡΡΡ ΠΏΡΠΎΠ±Π»Π΅ΠΌΡ.
ΠΠ°ΡΡΠΎΠ½ΡΡΡΠ΅ Π²Π΅ΡΡΠΈΠΈ ΠΠ
- Π―Π΄ΡΠΎ Linux Π΄ΠΎ Π²Π΅ΡΡΠΈΠΈ 3.3.6
Π’ΠΈΠΏ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΠΈ
- ΠΠ²Π°ΡΠΈΠΉΠ½ΠΎΠ΅ Π·Π°Π²Π΅ΡΡΠ΅Π½ΠΈΠ΅ ΡΠ°Π±ΠΎΡΡ (ΡΠΈΡΡΠ΅ΠΌΡ)
- ΠΡΠΊΠ°Π· Π² ΠΎΠ±ΡΠ»ΡΠΆΠΈΠ²Π°Π½ΠΈΠΈ (DoS)
- ΠΠΎΠ²ΡΡΠ΅Π½ΠΈΠ΅ ΠΏΡΠΈΠ²ΠΈΠ»Π΅Π³ΠΈΠΉ
ΠΠ°ΡΡΠΎΠ½ΡΡΡΠ΅ ΠΏΠ°ΠΊΠ΅ΡΡ
| ΠΠ»Π°ΡΡΠΎΡΠΌΠ° | ΠΠ°ΠΊΠ΅Ρ | Π‘ΠΎΡΡΠΎΡΠ½ΠΈΠ΅ | Π Π΅ΠΊΠΎΠΌΠ΅Π½Π΄Π°ΡΠΈΡ | Π Π΅Π»ΠΈΠ· |
|---|---|---|---|---|
| Red Hat Enterprise Linux 4 | kernel | Not affected | ||
| Red Hat Enterprise Linux 5 | kernel | Not affected | ||
| Red Hat Enterprise MRG 1 | kernel | Not affected | ||
| Red Hat Enterprise Linux 6 | kernel | Fixed | RHSA-2012:1426 | 06.11.2012 |
| Red Hat Enterprise Linux 6.2 EUS - Server and Compute Node Only | kernel | Fixed | RHSA-2013:0741 | 16.04.2013 |
| Red Hat Enterprise MRG 2 | kernel-rt | Fixed | RHSA-2012:1491 | 04.12.2012 |
ΠΠΎΠΊΠ°Π·ΡΠ²Π°ΡΡ ΠΏΠΎ
Π‘ΡΡΠ»ΠΊΠΈ Π½Π° ΠΈΡΡΠΎΡΠ½ΠΈΠΊΠΈ
ΠΠΎΠΏΠΎΠ»Π½ΠΈΡΠ΅Π»ΡΠ½Π°Ρ ΠΈΠ½ΡΠΎΡΠΌΠ°ΡΠΈΡ
Π‘ΡΠ°ΡΡΡ:
6.2 Medium
CVSS2
Π‘Π²ΡΠ·Π°Π½Π½ΡΠ΅ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΠΈ
Use-after-free vulnerability in the Linux kernel before 3.3.6, when huge pages are enabled, allows local users to cause a denial of service (system crash) or possibly gain privileges by interacting with a hugetlbfs filesystem, as demonstrated by a umount operation that triggers improper handling of quota data.
Use-after-free vulnerability in the Linux kernel before 3.3.6, when huge pages are enabled, allows local users to cause a denial of service (system crash) or possibly gain privileges by interacting with a hugetlbfs filesystem, as demonstrated by a umount operation that triggers improper handling of quota data.
Use-after-free vulnerability in the Linux kernel before 3.3.6, when hu ...
Use-after-free vulnerability in the Linux kernel before 3.3.6, when huge pages are enabled, allows local users to cause a denial of service (system crash) or possibly gain privileges by interacting with a hugetlbfs filesystem, as demonstrated by a umount operation that triggers improper handling of quota data.
ELSA-2012-2044: Unbreakable Enterprise kernel security update (MODERATE)
6.2 Medium
CVSS2