Linux Kernel 'perf_counter_open()' Local Buffer Overflow Vulnerability
BID:36423
Info
Linux Kernel 'perf_counter_open()' Local Buffer Overflow Vulnerability
| Bugtraq ID: | 36423 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Sep 16 2009 12:00AM |
| Updated: | Sep 18 2009 07:30AM |
| Credit: | Xiao Guangrong |
| Vulnerable: |
Linux kernel 2.6.31 -rc7 Linux kernel 2.6.31 -rc6 Linux kernel 2.6.31 -rc3 Linux kernel 2.6.31 -rc1 Linux kernel 2.6.31 Linux kernel 2.6.31-rc9 Linux kernel 2.6.31-rc8 Linux kernel 2.6.31-rc7 Linux kernel 2.6.31-rc5-git3 |
| Not Vulnerable: | |
Discussion
Linux Kernel 'perf_counter_open()' Local Buffer Overflow Vulnerability
The Linux kernel is prone to a local buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.
Local attackers may be able to exploit this issue to run arbitrary code with elevated privileges. Failed exploit attempts may crash the affected kernel, denying service to legitimate users.
The Linux Kernel 2.6.31-rc1 through 2.6.31 are vulnerable.
The Linux kernel is prone to a local buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.
Local attackers may be able to exploit this issue to run arbitrary code with elevated privileges. Failed exploit attempts may crash the affected kernel, denying service to legitimate users.
The Linux Kernel 2.6.31-rc1 through 2.6.31 are vulnerable.
Exploit / POC
Linux Kernel 'perf_counter_open()' Local Buffer Overflow Vulnerability
The following exploit is available:
The following exploit is available:
Solution / Fix
Linux Kernel 'perf_counter_open()' Local Buffer Overflow Vulnerability
Solution:
Updates are available. Please see the references for details.
Solution:
Updates are available. Please see the references for details.
References
Linux Kernel 'perf_counter_open()' Local Buffer Overflow Vulnerability
References:
References:
- Linux kernel Homepage (kernel.org)
- perf_counter: Fix buffer overflow in perf_copy_attr() (Xiao Guangrong)