Linux Kernel 'keyring_detect_cycle_iterator()' Function Local Denial of Service Vulnerability

Bugtraq ID:	65961
Class:	Design Error
CVE:	CVE-2014-0102
Remote:	No
Local:	Yes
Published:	Mar 04 2014 12:00AM
Updated:	Mar 04 2014 12:00AM
Credit:	Tommi Rantala
Vulnerable:	Linux Linux Kernel 3.14.0-rc3
Not Vulnerable:

Linux Kernel 'keyring_detect_cycle_iterator()' Function Local Denial of Service Vulnerability

The Linux kernel is prone to a local denial-of-service vulnerability.

Successful exploits will allow local users to crash the system, denying service to legitimate users.

Linux kernel 3.14.0-rc3 is vulnerable.

Linux Kernel 'keyring_detect_cycle_iterator()' Function Local Denial of Service Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Linux Kernel 'keyring_detect_cycle_iterator()' Function Local Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Linux Kernel 'keyring_detect_cycle_iterator()' Function Local Denial of Service Vulnerability

References:

• [PATCH] KEYS: Make the keyring cycle detector ignore other keyrings of the same ( David Howells)
  
• CVE-2014-0102 kernel: security: keyring cycle detector DoS (Red Hat)
  
• kernel BUG at security/keys/keyring.c:1003! (Tommi Rantala)
  
• Linux kernel Homepage (kernel.org)