Linux Kernel 'drivers/char/tty_ldisc.c' NULL Pointer Dereference Denial of Service Vulnerability

Bugtraq ID:	36191
Class:	Design Error
CVE:	CVE-2009-3043
Remote:	No
Local:	Yes
Published:	Aug 19 2009 12:00AM
Updated:	Apr 13 2015 09:07PM
Credit:	Eric W. Biederman
Vulnerable:	Linux kernel 2.6.31 -rc7 + Trustix Secure Enterprise Linux 2.0 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 Linux kernel 2.6.31 -rc6 + Trustix Secure Enterprise Linux 2.0 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 Linux kernel 2.6.31 -rc3 + Trustix Secure Enterprise Linux 2.0 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 Linux kernel 2.6.30 .1 Linux kernel 2.6.30 -rc6 Linux kernel 2.6.30 -rc5 Linux kernel 2.6.30 -rc3 Linux kernel 2.6.30 -rc2 Linux kernel 2.6.30 -rc1 Linux kernel 2.6.30 Linux kernel 2.6.29 .4 Linux kernel 2.6.29 .1 Linux kernel 2.6.29 -git8 Linux kernel 2.6.29 -git14 Linux kernel 2.6.29 -git1 Linux kernel 2.6.29 Linux kernel 2.6.28 .9 Linux kernel 2.6.28 .8 Linux kernel 2.6.28 .6 Linux kernel 2.6.28 .5 Linux kernel 2.6.28 .3 Linux kernel 2.6.28 .2 Linux kernel 2.6.28 .1 Linux kernel 2.6.28 -rc7 Linux kernel 2.6.28 -rc5 Linux kernel 2.6.28 -rc1 Linux kernel 2.6.28 -git7 Linux kernel 2.6.28 Linux kernel 2.6.27 6 Linux kernel 2.6.27 3 Linux kernel 2.6.27 12 Linux kernel 2.6.27 .8 Linux kernel 2.6.27 .5 Linux kernel 2.6.27 .5 Linux kernel 2.6.27 .24 Linux kernel 2.6.27 .14 Linux kernel 2.6.27 .13 Linux kernel 2.6.27 .12 Linux kernel 2.6.27 -rc8-git5 Linux kernel 2.6.27 -rc8 Linux kernel 2.6.27 -rc6-git6 Linux kernel 2.6.27 -rc6 Linux kernel 2.6.27 -rc5 Linux kernel 2.6.27 -rc2 Linux kernel 2.6.27 -rc1 Linux kernel 2.6.27 Linux kernel 2.6.26 7 Linux kernel 2.6.26 .6 Linux kernel 2.6.26 .4 Linux kernel 2.6.26 .3 Linux kernel 2.6.26 -rc6 Linux kernel 2.6.26 Linux kernel 2.6.31-rc5-git3 Linux kernel 2.6.30.5 Linux kernel 2.6.30.4 Linux kernel 2.6.30.3 Linux kernel 2.6.29-rc2-git1 Linux kernel 2.6.29-rc2 Linux kernel 2.6.29-rc1 Linux kernel 2.6.28.4 Linux kernel 2.6.26.1 Linux kernel 2.6.26-rc5-git1
Not Vulnerable:	Linux kernel 2.6.31-rc8 + Trustix Secure Enterprise Linux 2.0 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0

Linux Kernel 'drivers/char/tty_ldisc.c' NULL Pointer Dereference Denial of Service Vulnerability

The Linux kernel is prone to a local denial-of-service vulnerability.

Attackers can exploit this issue to crash the affected kernel, denying service to legitimate users. Given the nature of this issue, attackers may also be able to execute arbitrary code, but this has not been confirmed.

This issue was introduced in Linux kernel 2.6.26 and fixed in 2.6.31-rc8.

Linux Kernel 'drivers/char/tty_ldisc.c' NULL Pointer Dereference Denial of Service Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/36191.c

Linux Kernel 'drivers/char/tty_ldisc.c' NULL Pointer Dereference Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for details.


Linux kernel 2.6.26.1

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.30.4

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.29-rc1

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.31-rc5-git3

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.29-rc2

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.30.3

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.29-rc2-git1

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.30.5

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.28.4

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.26-rc5-git1

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.26 .4

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.26 .3

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.26 .6

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.26

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.26 7

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.26 -rc6

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.27 .8

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.27 .12

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.27

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.27 12

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.27 -rc1

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.27 -rc2

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.27 6

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.27 .14

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.27 3

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.27 -rc6

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.27 .24

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.27 -rc5

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.27 -rc8

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.27 .5

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.27 -rc6-git6

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.27 .5

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.27 .13

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.27 -rc8-git5

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.28 .2

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.28 .5

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.28

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.28 .8

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.28 .1

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.28 .9

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.28 -rc1

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.28 -rc5

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.28 .6

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.28 .3

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.28 -rc7

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.28 -git7

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.29 -git14

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.29

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.29 .1

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.29 -git8

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.29 .4

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.29 -git1

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.30 -rc1

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.30

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.30 -rc6

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.30 -rc3

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.30 -rc5

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.30 -rc2

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.30 .1

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.31 -rc7

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.31 -rc6

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux kernel 2.6.31 -rc3

• Linux linux-2.6.31-rc8.tar.bz2
  http://www.kernel.org/pub/linux/kernel/v2.6/testing/linux-2.6.31-rc8.t ar.bz2

Linux Kernel 'drivers/char/tty_ldisc.c' NULL Pointer Dereference Denial of Service Vulnerability

References:

• ChangeLog-2.6.31-rc8 (Linux)
  
• Linux kernel Homepage (kernel.org)
  
• Re: v2.6.31-rc6: BUG: unable to handle kernel NULL pointer dereference at 000000 (Eric W. Biederman)
  
• Re: v2.6.31-rc6: BUG: unable to handle kernel NULL pointer dereference at 000000 (Dave Young)
  
• tty: make sure to flush any pending work when halting the ldisc (Linus Torvalds)
  
• v2.6.31-rc6: BUG: unable to handle kernel NULL pointer dereference at 0000000000 (Eric W. Biederman)