oss-security - Re: CVE request: kernel: inotify local DoS

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 18 Mar 2009 13:41:28 -0400
From: "Michael K. Johnson" <johnsonm@...th.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: kernel: inotify local DoS

On Tue, Mar 17, 2009 at 08:39:33PM -0400, Steven M. Christey wrote:
> 
> ======================================================
> Name: CVE-2009-0935
> Status: Candidate
> URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0935
> Reference: MLIST:[linux-kernel] 20090131 [patch 03/43] inotify: clean up inotify_read and fix locking
> Reference: URL:http://marc.info/?l=linux-kernel&m=123337123501681&w=2
> Reference: MLIST:[oss-security] 20090306 CVE request: kernel: inotify local DoS
> Reference: URL:http://www.openwall.com/lists/oss-security/2009/03/06/2
> Reference: CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=488935
> 
> The inotify_read function in the Linux kernel 2.6 before 2.6.29-rc3
> allows local users to cause a denial of service (OOPS) via a read with
> an invalid address to an inotify instance, which causes the device's
> event list mutex to be unlocked twice and prevents proper
> synchronization of a data structure for the inotify instance.

In the 2.6.27.y stable releases, this affects 2.6.27.13 and earlier.
In the 2.6.28.y stable releases, this affects 2.6.28.2 and earlier.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.