Bug 231347 (CVE-2008-3077)

Summary:	Linux <2.6.25.10 x86_64 ptrace: fix sys32_ptrace task_struct leak (CVE-2008-3077)
Product:	Gentoo Security	Reporter:	Robert Buchholz (RETIRED) <rbu>
Component:	Kernel	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	jaak, kernel
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	[linux <2.6.25.10]
Package list:		Runtime testing required:	---

Description Robert Buchholz (RETIRED) gentoo-dev

2008-07-09 21:41:43 UTC

CVE-2008-3077 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3077):
  arch/x86/kernel/ptrace.c in the Linux kernel before 2.6.25.10 on the x86_64
  platform leaks task_struct references into the sys32_ptrace function, which
  allows local users to cause a denial of service (system crash) or have
  unspecified other impact via unknown vectors, possibly a use-after-free
  vulnerability.

Comment 1 RumpletonBongworth 2009-07-20 19:21:23 UTC

hardened-kernel unaffected at present time. Removing alias.

PS: Anything using >=genpatches-2.6.25-8 is unaffected