CERT-In Vulnerability Note
CIVN-2012-0106
Linux Kernel ¿xacct_add_tsk()¿ Local Denial of Service Vulnerability
Original Issue Date:October 15, 2012
Severity Rating: MEDIUM
Systems Affected
- Linux Kernel versions prior to 2.6.19
Overview
A vulnerability has been reported in Linux kernel, which could be exploited by local attackers to obtain potentially sensitive information from kernel memory or cause a denial of service (system crash) .
Description
This vulnerability exist in Linux kernel due to a use-after-free memory error in xacct_add_tsk() function . A local attacker could exploit this vulnerability to trigger a kernel panic.
Successful exploitation of this vulnerability causes an information leakage or denial of service (DoS) via a taskstats TASKSTATS_CMD_ATTR_PID command .
Solution
Apply the source code fix:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=f0ec1aaf54caddd21c259aea8b2ecfbde4ee4fb9
Vendor Information
kernel.org
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=f0ec1aaf54caddd21c259aea8b2ecfbde4ee4fb9
www.kernel.org/
References
BugZilla
https://bugzilla.redhat.com/show_bug.cgi?id=849722
Security Tracker
http://securitytracker.com/id/1027602
Openwall
http://www.openwall.com/lists/oss-security/2012/08/20/12
CVE Name
CVE-2012-3510
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|