Bug 261991 (CVE-2009-0859)

Summary:	Kernel: fix shmctl(SHM_INFO) lockup with !CONFIG_SHMEM (CVE-2009-0859)
Product:	Gentoo Security	Reporter:	Robert Buchholz (RETIRED) <rbu>
Component:	Kernel	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	hardened-kernel+disabled, kernel
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a68e61e8ff2d46327a37b69056998b47745db6fa
Whiteboard:	[linux <2.6.27.16] [linux >=2.6.28 <2.6.28.5] [gp <2.6.27-11] [gp >=2.6.28-1 <2.6.28-3]
Package list:		Runtime testing required:	---

Description Robert Buchholz (RETIRED) gentoo-dev

2009-03-10 16:11:32 UTC

CVE-2009-0859 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0859):
  The shm_get_stat function in ipc/shm.c in the shm subsystem in the
  Linux kernel before 2.6.28.5, when CONFIG_SHMEM is disabled,
  misinterprets the data type of an inode, which allows local users to
  cause a denial of service (system hang) via an SHM_INFO shmctl call,
  as demonstrated by running the ipcs program.