Linux Kernel 'fuse_ioctl_copy_user()' Local Denial of Service Vulnerability

Bugtraq ID:	37453
Class:	Design Error
CVE:	CVE-2009-4410
Remote:	No
Local:	Yes
Published:	Dec 23 2009 12:00AM
Updated:	May 07 2015 05:05PM
Credit:	David Shaw
Vulnerable:	Pardus Linux 2009 0 Linux kernel 2.6.30 .1 Linux kernel 2.6.30 -rc6 Linux kernel 2.6.30 -rc5 Linux kernel 2.6.30 -rc3 Linux kernel 2.6.30 -rc2 Linux kernel 2.6.30 -rc1 Linux kernel 2.6.30 Linux kernel 2.6.29 .4 Linux kernel 2.6.29 .1 Linux kernel 2.6.29 -git8 Linux kernel 2.6.29 -git14 Linux kernel 2.6.29 -git1 Linux kernel 2.6.29 Linux kernel 2.6.30.5 Linux kernel 2.6.30.4 Linux kernel 2.6.30.3 Linux kernel 2.6.29-rc2-git1 Linux kernel 2.6.29-rc2 Linux kernel 2.6.29-rc1
Not Vulnerable:	Linux kernel 2.6.31

Linux Kernel 'fuse_ioctl_copy_user()' Local Denial of Service Vulnerability

The Linux kernel is prone to a local denial-of-service vulnerability.

Attackers can exploit this issue to cause the affected kernel to panic and stop responding, denying service to legitimate users.

This issue was introduced in Linux kernel 2.6.29-rc1 and fixed in Linux kernel 2.6.31.

Linux Kernel 'fuse_ioctl_copy_user()' Local Denial of Service Vulnerability

The reporter has created code to reproduce this issue, but it is not publicly available.

Linux Kernel 'fuse_ioctl_copy_user()' Local Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.

Linux Kernel 'fuse_ioctl_copy_user()' Local Denial of Service Vulnerability

References:

• Bug 549400 - kernel: fuse_ioctl_copy_user() dos (David Shaw)
  
• fuse: fix kunmap in fuse_ioctl_copy_user (Jens Axboe)
  
• CVE request - kernel: fuse_ioctl_copy_user() dos (Eugene Teo)
  
• Linux kernel Homepage (kernel.org)