HP-UX mmap() Denial of Service Vulnerability

Bugtraq ID:	3817
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	No
Local:	Yes
Published:	Jan 08 2002 12:00AM
Updated:	Jan 08 2002 12:00AM
Credit:	Published in HP Security Bulletin HPSBUX0201-178 on January 7, 2002.
Vulnerable:	HP HP-UX (VVOS) 11.0 4 HP HP-UX 11.11 HP HP-UX 11.0 HP HP-UX 10.20 Series 800 HP HP-UX 10.20 Series 700
Not Vulnerable:

HP-UX mmap() Denial of Service Vulnerability

The HP-UX kernel contains a vulnerability that may allow for local users to cause a denial of service.

The condition is present when a process maps a file to a memory buffer (using the mmap() system call). If the process attempts to perform an I/O operation using data from the mapped buffer on the file descriptor for the mapped file, a kernel deadlock will occur.

Local users with no special privileges can exploit this vulnerability to cause the kernel to freeze, resulting in a system-wide denial of service.

HP-UX mmap() Denial of Service Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

HP-UX mmap() Denial of Service Vulnerability

Solution:
Fixes are available:


HP HP-UX 10.20 Series 800

• HP PHKL_24518
  

HP HP-UX 10.20 Series 700

• HP PHKL_24517
  

HP HP-UX 11.0

• HP PHKL_22932
  

HP HP-UX (VVOS) 11.0 4

• HP PHKL_25033
  

HP HP-UX 11.11

• HP PHKL_23335
  

HP-UX mmap() Denial of Service Vulnerability

References:

• HP IT Resource Center (for Europe) (HP IT Resource Center)
  
• HP IT Resource Center (for US, Canada, Asia-Pacific, & Latin-America) (HP IT Resource Center)