BID:26880

Linux Kernel 'hrtimers' Local Denial of Service Vulnerability

Info

Linux Kernel 'hrtimers' Local Denial of Service Vulnerability

Bugtraq ID:	26880
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2007-5966
Remote:	No
Local:	Yes
Published:	Dec 14 2007 12:00AM
Updated:	Feb 02 2010 09:41PM
Credit:	The vendor disclosed this issue.
Vulnerable:	VMWare vMA 4.0 VMWare ESX Server 4.0 Ubuntu Ubuntu Linux 7.10 sparc Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu Ubuntu Linux 7.10 i386 Ubuntu Ubuntu Linux 7.10 amd64 Ubuntu Ubuntu Linux 7.04 sparc Ubuntu Ubuntu Linux 7.04 powerpc Ubuntu Ubuntu Linux 7.04 i386 Ubuntu Ubuntu Linux 7.04 amd64 Ubuntu Ubuntu Linux 6.10 sparc Ubuntu Ubuntu Linux 6.10 powerpc Ubuntu Ubuntu Linux 6.10 i386 Ubuntu Ubuntu Linux 6.10 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 SuSE SUSE Linux Enterprise SDK 10 SP1 SuSE Suse Linux Enterprise Desktop 10 SP1 SuSE SUSE Linux Enterprise 10 SP1 DEBUGINFO SuSE Linux Enterprise Server 10.SP1 SuSE Linux 10.1 x86-64 SuSE Linux 10.1 x86 SuSE Linux 10.1 ppc S.u.S.E. openSUSE 10.3 S.u.S.E. openSUSE 10.2 rPath rPath Linux 1 rPath Appliance Platform Linux Service 1 Redhat Enterprise MRG v1 for Red Hat Enterprise Linux version 5 Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux 5.2.z server Redhat Enterprise Linux 5 Server Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 Linux kernel 2.6.23 .7 Linux kernel 2.6.23 .6 Linux kernel 2.6.23 .5 Linux kernel 2.6.23 .4 Linux kernel 2.6.23 .3 Linux kernel 2.6.23 .2 Linux kernel 2.6.23 -rc2 Linux kernel 2.6.23 -rc1 Linux kernel 2.6.23 Linux kernel 2.6.23.1 Linux kernel 2.6.23.09 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0

Not Vulnerable:	VMWare vMA 4.0 Patch 2 Linux kernel 2.6.23.10

Discussion

Linux Kernel 'hrtimers' Local Denial of Service Vulnerability

The Linux kernel is prone to a local denial-of-service vulnerability because it fails to properly handle certain 'hrtimers' relative timeout values.

Attackers can exploit this issue to trigger kernel crashes, denying service to legitimate users. Given the nature of this issue, attackers may also be able to execute arbitrary code, but this has not been confirmed.

Versions prior to Linux kernel 2.6.23.10 are vulnerable.

Exploit / POC

Linux Kernel 'hrtimers' Local Denial of Service Vulnerability

Currently we are not aware of any working exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Solution / Fix

Linux Kernel 'hrtimers' Local Denial of Service Vulnerability

Solution:
This issue was addressed in Linux kernel 2.6.23.10. Please see the references for more information.

Linux kernel 2.6.23 .5