Linux Kernel PTE Pages OOM Score Denial of Service Vulnerability

Bugtraq ID:	48477
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2011-2498
Remote:	No
Local:	Yes
Published:	Jun 28 2011 12:00AM
Updated:	Mar 06 2012 09:10PM
Credit:	Dave Hansen
Vulnerable:	Ubuntu Ubuntu Linux 11.04 powerpc Ubuntu Ubuntu Linux 11.04 i386 Ubuntu Ubuntu Linux 11.04 ARM Ubuntu Ubuntu Linux 11.04 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Linux kernel 2.6.39 rc4 Linux kernel 2.6.39 Linux kernel 2.6.38 Linux kernel 2.6.37 Linux kernel 2.6.37 Linux kernel 2.6.39-rc3 Linux kernel 2.6.38.6 Linux kernel 2.6.38.4 Linux kernel 2.6.38.3 Linux kernel 2.6.38.2 Linux kernel 2.6.38-rc7 Linux kernel 2.6.38-rc4 Linux kernel 2.6.38-rc2 Linux kernel 2.6.37rc Linux kernel 2.6.37-rc7 Linux kernel 2.6.37-rc2 Linux kernel 2.6.37-rc1 Linux kernel 2.6.36.2 (stable) Linux kernel 2.6.36-rc8 Linux kernel 2.6.36-rc6 Linux kernel 2.6.36-rc5 Linux kernel 2.6.36-rc4 Linux kernel 2.6.36-rc1
Not Vulnerable:	Linux kernel 2.6.39-rc6

Linux Kernel PTE Pages OOM Score Denial of Service Vulnerability

The Linux kernel is prone to a local denial-of-service vulnerability.

Attackers can exploit this issue to crash the kernel, denying service to legitimate users.

This issue was introduced in Linux kernel 2.6.36-rc1 and fixed in 2.6.39-rc6.

Linux Kernel PTE Pages OOM Score Denial of Service Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Linux Kernel PTE Pages OOM Score Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.

Linux Kernel PTE Pages OOM Score Denial of Service Vulnerability

References:

• Linux kernel Homepage (kernel.org)
  
• oom: use pte pages in OOM score (KOSAKI Motohiro)