Bug 245019 (CVE-2008-4302)

Summary:	Linux <2.6.22.2 splice: fix bad unlock_page() in error case (CVE-2008-4302)
Product:	Gentoo Security	Reporter:	Robert Buchholz (RETIRED) <rbu>
Component:	Kernel	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	[linux <2.6.23]
Package list:		Runtime testing required:	---

Description Robert Buchholz (RETIRED) gentoo-dev

2008-10-30 22:20:49 UTC

CVE-2008-4302 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4302):
  fs/splice.c in the splice subsystem in the Linux kernel before
  2.6.22.2 does not properly handle a failure of the
  add_to_page_cache_lru function, and subsequently attempts to unlock a
  page that was not locked, which allows local users to cause a denial
  of service (kernel BUG and system crash), as demonstrated by the fio
  I/O tool.