Linux Kernel utrace and ptrace Local Denial of Service Vulnerability
BID:29945
Info
Linux Kernel utrace and ptrace Local Denial of Service Vulnerability
| Bugtraq ID: | 29945 |
| Class: | Race Condition Error |
| CVE: |
CVE-2008-2365 |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 25 2008 12:00AM |
| Updated: | Jul 16 2008 06:29PM |
| Credit: | Alexei Dobryanov |
| Vulnerable: |
Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 7.10 sparc Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu Ubuntu Linux 7.10 lpia Ubuntu Ubuntu Linux 7.10 i386 Ubuntu Ubuntu Linux 7.10 amd64 Ubuntu Ubuntu Linux 7.04 sparc Ubuntu Ubuntu Linux 7.04 powerpc Ubuntu Ubuntu Linux 7.04 i386 Ubuntu Ubuntu Linux 7.04 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Redhat Enterprise Linux WS 4 Redhat Enterprise Linux ES 4 Redhat Enterprise Linux AS 4 Redhat Desktop 4.0 Linux kernel 2.6.25 .5 Linux kernel 2.6.25 Linux kernel 2.6.24 .2 Linux kernel 2.6.24 .1 Linux kernel 2.6.24 -rc5 Linux kernel 2.6.24 -rc4 Linux kernel 2.6.24 -rc3 Linux kernel 2.6.23 .7 Linux kernel 2.6.23 .6 Linux kernel 2.6.23 .5 Linux kernel 2.6.23 .4 Linux kernel 2.6.23 .3 Linux kernel 2.6.23 .2 Linux kernel 2.6.23 -rc2 Linux kernel 2.6.23 -rc1 Linux kernel 2.6.23 Linux kernel 2.6.22 .8 Linux kernel 2.6.22 .7 Linux kernel 2.6.22 .6 Linux kernel 2.6.22 .5 Linux kernel 2.6.22 .4 Linux kernel 2.6.22 .3 Linux kernel 2.6.22 .2 Linux kernel 2.6.22 .17 Linux kernel 2.6.22 .16 Linux kernel 2.6.22 .15 Linux kernel 2.6.22 .14 Linux kernel 2.6.22 .13 Linux kernel 2.6.22 .12 Linux kernel 2.6.22 .11 Linux kernel 2.6.22 .1 Linux kernel 2.6.22 Linux kernel 2.6.21 4 Linux kernel 2.6.21 .7 Linux kernel 2.6.21 .6 Linux kernel 2.6.21 .3 Linux kernel 2.6.21 .2 Linux kernel 2.6.21 .1 Linux kernel 2.6.21 -git8 Linux kernel 2.6.21 Linux kernel 2.6.20 .9 Linux kernel 2.6.20 .8 Linux kernel 2.6.20 .5 Linux kernel 2.6.20 .4 Linux kernel 2.6.20 .15 Linux kernel 2.6.20 .1 Linux kernel 2.6.20 Linux kernel 2.6.20 Linux kernel 2.6.19 .2 Linux kernel 2.6.19 .1 Linux kernel 2.6.19 .1 Linux kernel 2.6.19 -rc4 Linux kernel 2.6.19 -rc3 Linux kernel 2.6.19 -rc2 Linux kernel 2.6.19 -rc1 Linux kernel 2.6.19 Linux kernel 2.6.18 .4 Linux kernel 2.6.18 .3 Linux kernel 2.6.18 .1 Linux kernel 2.6.18 Linux kernel 2.6.17 .9 Linux kernel 2.6.17 .8 Linux kernel 2.6.17 .7 Linux kernel 2.6.17 .6 Linux kernel 2.6.17 .5 Linux kernel 2.6.17 .4 Linux kernel 2.6.17 .3 Linux kernel 2.6.17 .2 Linux kernel 2.6.17 .14 Linux kernel 2.6.17 .13 Linux kernel 2.6.17 .12 Linux kernel 2.6.17 .11 Linux kernel 2.6.17 .10 Linux kernel 2.6.17 .1 Linux kernel 2.6.17 -rc5 Linux kernel 2.6.17 Linux kernel 2.6.17 Linux kernel 2.6.17 Linux kernel 2.6.17 Linux kernel 2.6.16 27 Linux kernel 2.6.16 13 Linux kernel 2.6.16 .9 Linux kernel 2.6.16 .8 Linux kernel 2.6.16 .7 Linux kernel 2.6.16 .5 Linux kernel 2.6.16 .4 Linux kernel 2.6.16 .3 Linux kernel 2.6.16 .23 Linux kernel 2.6.16 .21 Linux kernel 2.6.16 .2 Linux kernel 2.6.16 .19 Linux kernel 2.6.16 .18 Linux kernel 2.6.16 .17 Linux kernel 2.6.16 .16 Linux kernel 2.6.16 .12 Linux kernel 2.6.16 .11 Linux kernel 2.6.16 .1 Linux kernel 2.6.16 -rc1 Linux kernel 2.6.16 Linux kernel 2.6.16 Linux kernel 2.6.15 .6 Linux kernel 2.6.15 .4 Linux kernel 2.6.15 .3 Linux kernel 2.6.15 .2 Linux kernel 2.6.15 .1 Linux kernel 2.6.15 -rc6 Linux kernel 2.6.15 -rc5 Linux kernel 2.6.15 -rc4 Linux kernel 2.6.15 -rc3 Linux kernel 2.6.15 -rc2 Linux kernel 2.6.15 -rc1 Linux kernel 2.6.15 Linux kernel 2.6.15 Linux kernel 2.6.14 .5 Linux kernel 2.6.14 .4 Linux kernel 2.6.14 .3 Linux kernel 2.6.14 .2 Linux kernel 2.6.14 .1 Linux kernel 2.6.14 -rc4 Linux kernel 2.6.14 -rc3 Linux kernel 2.6.14 -rc2 Linux kernel 2.6.14 -rc1 Linux kernel 2.6.14 Linux kernel 2.6.14 Linux kernel 2.6.13 .4 Linux kernel 2.6.13 .3 Linux kernel 2.6.13 .2 Linux kernel 2.6.13 .1 Linux kernel 2.6.13 -rc7 Linux kernel 2.6.13 -rc6 Linux kernel 2.6.13 -rc4 Linux kernel 2.6.13 -rc1 Linux kernel 2.6.13 Linux kernel 2.6.13 Linux kernel 2.6.12 .6 Linux kernel 2.6.12 .5 Linux kernel 2.6.12 .4 Linux kernel 2.6.12 .3 Linux kernel 2.6.12 .22 Linux kernel 2.6.12 .2 Linux kernel 2.6.12 .12 Linux kernel 2.6.12 .1 Linux kernel 2.6.12 -rc5 Linux kernel 2.6.12 -rc4 Linux kernel 2.6.12 -rc1 Linux kernel 2.6.12 Linux kernel 2.6.12 Linux kernel 2.6.11 .8 Linux kernel 2.6.11 .7 Linux kernel 2.6.11 .6 Linux kernel 2.6.11 .5 Linux kernel 2.6.11 .4 Linux kernel 2.6.11 .12 Linux kernel 2.6.11 .11 Linux kernel 2.6.11 -rc4 Linux kernel 2.6.11 -rc3 Linux kernel 2.6.11 -rc2 Linux kernel 2.6.11 Linux kernel 2.6.11 Linux kernel 2.6.10 rc2 Linux kernel 2.6.10 Linux kernel 2.6.10 Linux kernel 2.6.9 Linux kernel 2.6.25.4 Linux kernel 2.6.25.3 Linux kernel 2.6.25.2 Linux kernel 2.6.25.1 Linux kernel 2.6.24.6 Linux kernel 2.6.24-rc2 Linux kernel 2.6.24-rc1 Linux kernel 2.6.23.14 Linux kernel 2.6.23.10 Linux kernel 2.6.23.1 Linux kernel 2.6.23.09 Linux kernel 2.6.22-rc7 Linux kernel 2.6.22-rc1 Linux kernel 2.6.21-RC6 Linux kernel 2.6.21-RC5 Linux kernel 2.6.21-RC4 Linux kernel 2.6.21-RC3 Linux kernel 2.6.21-RC3 Linux kernel 2.6.20.3 Linux kernel 2.6.20.2 Linux kernel 2.6.20.13 Linux kernel 2.6.20.11 Linux kernel 2.6.20-rc2 Linux kernel 2.6.20-2 Linux kernel 2.6.18-8.1.8.el5 Linux kernel 2.6.18-53 Linux kernel 2.6.18 Linux kernel 2.6.15.5 Linux kernel 2.6.15.11 Linux kernel 2.6.15-27.48 Linux kernel 2.6.11.4 |
| Not Vulnerable: | |
Discussion
Linux Kernel utrace and ptrace Local Denial of Service Vulnerability
The Linux kernel is prone to a local denial-of-service vulnerability caused by a race condition.
Attackers can exploit this issue to cause the kernel to become unresponsive, denying service to legitimate users.
The Linux kernel is prone to a local denial-of-service vulnerability caused by a race condition.
Attackers can exploit this issue to cause the kernel to become unresponsive, denying service to legitimate users.
Exploit / POC
Linux Kernel utrace and ptrace Local Denial of Service Vulnerability
The following exploit code is available:
The following exploit code is available:
Solution / Fix
Linux Kernel utrace and ptrace Local Denial of Service Vulnerability
Solution:
Updates are available. Please see the references for more information.
Linux kernel 2.6.25.3
Linux kernel 2.6.25.2
Linux kernel 2.6.25 .5
Solution:
Updates are available. Please see the references for more information.
Linux kernel 2.6.25.3
-
Linux [PATCH] fix zap_thread's ptrace related problems
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git;a= commit;h=5ecfbae093f0c37311e89b29bfc0c9d586eace87 -
Linux Fix ptrace_attach()/ptrace_traceme()/de_thread() race
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git;a= commit;h=f5b40e363ad6041a96e3da32281d8faa191597b9 -
Linux ptrace_attach: fix possible deadlock schenario with irqs
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git;a= commit;h=f358166a9405e4f1d8e50d8f415c26d95505b6de
Linux kernel 2.6.25.2
-
Linux [PATCH] fix zap_thread's ptrace related problems
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git;a= commit;h=5ecfbae093f0c37311e89b29bfc0c9d586eace87 -
Linux Fix ptrace_attach()/ptrace_traceme()/de_thread() race
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git;a= commit;h=f5b40e363ad6041a96e3da32281d8faa191597b9 -
Linux ptrace_attach: fix possible deadlock schenario with irqs
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git;a= commit;h=f358166a9405e4f1d8e50d8f415c26d95505b6de
Linux kernel 2.6.25 .5
-
Linux [PATCH] fix zap_thread's ptrace related problems
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git;a= commit;h=5ecfbae093f0c37311e89b29bfc0c9d586eace87 -
Linux Fix ptrace_attach()/ptrace_traceme()/de_thread() race
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git;a= commit;h=f5b40e363ad6041a96e3da32281d8faa191597b9 -
Linux ptrace_attach: fix possible deadlock schenario with irqs
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git;a= commit;h=f358166a9405e4f1d8e50d8f415c26d95505b6de
References
Linux Kernel utrace and ptrace Local Denial of Service Vulnerability
References:
References:
- Bugzilla Bug 449359: CVE-2008-2365 kernel: ptrace: Crash on PTRACE_{ATTACH,DETA (Jan Lieskovsky)
- CVE-2008-2365 kernel: ptrace: Crash on PTRACE_{ATTACH,DETACH} race -- affecting (Jan Lieskovsky)
- Linux kernel Homepage (kernel.org)
- RHSA-2008:0508-21 kernel security and bug fix update (Red Hat)
- USN-625-1: Linux kernel vulnerabilities (Ubuntu)