Date: Thu, 15 Apr 2010 08:37:41 +0800 From: Eugene Teo <eugene@...hat.com> To: oss-security@...ts.openwall.com CC: Michael Gilbert <michael.s.gilbert@...il.com>, coley@...re.org Subject: CVE request: kernel: tty: release_one_tty() forgets to put pids On 04/15/2010 08:23 AM, Michael Gilbert wrote: > On Wed, 14 Apr 2010 11:20:00 +0800 Eugene Teo wrote: > >> 2) tty: release_one_tty() forgets to put pids >> https://bugzilla.redhat.com/show_bug.cgi?id=582076 >> http://git.kernel.org/linus/6da8d866d0d39e9509ff826660f6a86a6757c966 >> Not sure this issue can be triggered by a non-privileged user. > > this one should get a CVE id i think. looking at only two data points > (2.6.26 and 2.6.32), i've found the vulnerable code present in both. > if i'm not mistaken, redhat has had supported releases in that range. Was discussing this with another colleague, that it seems possible to trigger this issue with a non-privileged user. And yes, I agree that this should have a CVE name assigned. Thanks. Eugene
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ