oss-security - CVE request: kernel: tty: release_one

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 15 Apr 2010 08:37:41 +0800
From: Eugene Teo <eugene@...hat.com>
To: oss-security@...ts.openwall.com
CC: Michael Gilbert <michael.s.gilbert@...il.com>, coley@...re.org
Subject: CVE request: kernel: tty: release_one_tty() forgets to put pids

On 04/15/2010 08:23 AM, Michael Gilbert wrote:
> On Wed, 14 Apr 2010 11:20:00 +0800 Eugene Teo wrote:
>
>> 2) tty: release_one_tty() forgets to put pids
>> https://bugzilla.redhat.com/show_bug.cgi?id=582076
>> http://git.kernel.org/linus/6da8d866d0d39e9509ff826660f6a86a6757c966
>> Not sure this issue can be triggered by a non-privileged user.
>
> this one should get a CVE id i think.  looking at only two data points
> (2.6.26 and 2.6.32), i've found the vulnerable code present in both.
> if i'm not mistaken, redhat has had supported releases in that range.

Was discussing this with another colleague, that it seems possible to 
trigger this issue with a non-privileged user. And yes, I agree that 
this should have a CVE name assigned. Thanks.

Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.