Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 14 May 2014 15:19:42 +0200
From: Greg KH <greg@...ah.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request Linux kernel: forbid uaddr == uaddr2
 in futex_wait_requeue_pi() to avoid null dereference

On Wed, May 14, 2014 at 06:41:14PM +0530, P J P wrote:
>     Hello,
> 
> Linux kernel built with the fast userspace mutexes(CONFIG_FUTEX) support is 
> vulnerable to a NULL pointer dereference flaw. It could occur when a waiting 
> task requests wait to be re-queued from non-PI futex to a PI-aware futex via 
> FUTEX_WAIT_REQUEUE_PI operation.
> 
> An unprivileged user/program could use this flaw to crash the system kernel 
> resulting in DoS.
> 
> Upstream fix:
> -------------
>    -> https://git.kernel.org/linus/6f7b0a2a5c0fb03be7c25bd1745baa50582348ef
> 
> Introduced in:
> --------------
>    -> https://git.kernel.org/linus/52400ba946759af28442dee6265c5c0180ac7122

Why are we asking for CVEs for patches that were written 2 years ago?

For those that do not know, the fix was in released kernel version 3.6.0

greg k-h

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.