Fedora 8/9 Linux Kernel 'utrace_control' NULL Pointer Dereference Denial of Service Vulnerability

Bugtraq ID:	31536
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2008-3832
Remote:	No
Local:	Yes
Published:	Oct 02 2008 12:00AM
Updated:	Apr 13 2015 09:50PM
Credit:	Michael Simms
Vulnerable:
Not Vulnerable:

Fedora 8/9 Linux Kernel 'utrace_control' NULL Pointer Dereference Denial of Service Vulnerability

Fedora 8 and 9 Linux kernel is prone to a local denial-of-service vulnerability.

Attackers can exploit this issue to crash the affected kernel, denying service to legitimate users. Given the nature of this issue, attackers may also be able to execute arbitrary code, but this has not been confirmed.

Note that this issue does not affect upstream kernel versions. Only the following Fedora distributions are affected:

Fedora 8 prior to kernel-2.6.26.5-28
Fedora 9 prior to kernel-2.6.26.5-45

Fedora 8/9 Linux Kernel 'utrace_control' NULL Pointer Dereference Denial of Service Vulnerability

An attacker can exploit this issue with readily available tools.

The following 'gdb' command is sufficient to trigger a kernel crash:

gdb any_executable 1

Fedora 8/9 Linux Kernel 'utrace_control' NULL Pointer Dereference Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.

Fedora 8/9 Linux Kernel 'utrace_control' NULL Pointer Dereference Denial of Service Vulnerability

References:

• Bug 464883 CVE-2008-3832 kernel: null pointer dereference in utrace_control (Eugene Teo)
  
• CVE-2008-3832 kernel: null pointer dereference in utrace_control (Eugene Teo)
  
• Fedora Homepage (RedHat)