Описание
The do_exit function in kernel/exit.c in the Linux kernel before 2.6.36.2 does not properly handle a KERNEL_DS get_fs value, which allows local users to bypass intended access_ok restrictions, overwrite arbitrary kernel memory locations, and gain privileges by leveraging a (1) BUG, (2) NULL pointer dereference, or (3) page fault, as demonstrated by vectors involving the clear_child_tid feature and the splice system call.
| Релиз | Статус | Примечание |
|---|---|---|
| dapper | DNE | |
| devel | not-affected | 2.6.39-0.0 |
| hardy | released | 2.6.24-29.88 |
| karmic | ignored | end of life, was pending |
| lucid | released | 2.6.32-28.52 |
| maverick | released | 2.6.35-25.43 |
| natty | released | 2.6.37-9.22 |
| upstream | released | 2.6.37~rc5 |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| dapper | DNE | |
| devel | DNE | |
| hardy | DNE | |
| karmic | ignored | end of life |
| lucid | released | 2.6.32-312.24 |
| maverick | ignored | end of life |
| natty | DNE | |
| upstream | released | 2.6.37~rc5 |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| dapper | DNE | |
| devel | DNE | |
| hardy | DNE | |
| karmic | ignored | end of life |
| lucid | released | 2.6.31-609.26 |
| maverick | DNE | |
| natty | DNE | |
| upstream | released | 2.6.37~rc5 |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| dapper | DNE | |
| devel | DNE | |
| hardy | DNE | |
| karmic | DNE | |
| lucid | released | 2.6.35-25.44~lucid1 |
| maverick | DNE | |
| natty | DNE | |
| upstream | released | 2.6.37~rc5 |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| hardy | DNE | |
| lucid | not-affected | 2.6.38-1.27~lucid1 |
| maverick | DNE | |
| natty | DNE | |
| upstream | released | 2.6.37~rc5 |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| dapper | DNE | |
| devel | DNE | |
| hardy | DNE | |
| karmic | ignored | end of life |
| lucid | released | 2.6.32-214.30 |
| maverick | released | 2.6.32-414.30 |
| natty | DNE | |
| upstream | released | 2.6.37~rc5 |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| dapper | released | 2.6.15-57.97 |
| devel | DNE | |
| hardy | DNE | |
| karmic | DNE | |
| lucid | DNE | |
| maverick | DNE | |
| natty | DNE | |
| upstream | released | 2.6.37~rc5 |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| dapper | DNE | |
| devel | not-affected | 2.6.38-1309.13 |
| hardy | DNE | |
| karmic | DNE | |
| lucid | DNE | |
| maverick | released | 2.6.35-903.22 |
| natty | not-affected | 2.6.38-1201.2 |
| upstream | released | 2.6.37~rc5 |
Показывать по
Ссылки на источники
EPSS
6.2 Medium
CVSS2
Связанные уязвимости
The do_exit function in kernel/exit.c in the Linux kernel before 2.6.36.2 does not properly handle a KERNEL_DS get_fs value, which allows local users to bypass intended access_ok restrictions, overwrite arbitrary kernel memory locations, and gain privileges by leveraging a (1) BUG, (2) NULL pointer dereference, or (3) page fault, as demonstrated by vectors involving the clear_child_tid feature and the splice system call.
The do_exit function in kernel/exit.c in the Linux kernel before 2.6.36.2 does not properly handle a KERNEL_DS get_fs value, which allows local users to bypass intended access_ok restrictions, overwrite arbitrary kernel memory locations, and gain privileges by leveraging a (1) BUG, (2) NULL pointer dereference, or (3) page fault, as demonstrated by vectors involving the clear_child_tid feature and the splice system call.
The do_exit function in kernel/exit.c in the Linux kernel before 2.6.3 ...
The do_exit function in kernel/exit.c in the Linux kernel before 2.6.36.2 does not properly handle a KERNEL_DS get_fs value, which allows local users to bypass intended access_ok restrictions, overwrite arbitrary kernel memory locations, and gain privileges by leveraging a (1) BUG, (2) NULL pointer dereference, or (3) page fault, as demonstrated by vectors involving the clear_child_tid feature and the splice system call.
EPSS
6.2 Medium
CVSS2