oss-security - CVE Request -- kernel: mm: use-after-free in madvise

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120820180704.GG5405@dhcp-25-225.brq.redhat.com>
Date: Mon, 20 Aug 2012 20:07:04 +0200
From: Petr Matousek <pmatouse@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE Request -- kernel: mm: use-after-free in madvise_remove()

A use-after-free flaw has been found in madvise_remove() function in the
Linux kernel. madvise_remove() can race with munmap (causing a
use-after-free of the vma) or with close (causing a use-after-free of the
struct file). An unprivileged local user can use this flaw to crash the
system.

Upstream fix:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=9ab4233dd08036fe34a89c7dc6f47a8bf2eb29eb

Introduced in:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=90ed52ebe48181d3c5427b3bd1d24f659e7575ad

References:
https://bugzilla.redhat.com/show_bug.cgi?id=849734

Thanks,
-- 
Petr Matousek / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.