Bug 270328

Summary:	Kernel: zero pages before sending to userspace (CVE-2009-1192)
Product:	Gentoo Security	Reporter:	Robert Buchholz (RETIRED) <rbu>
Component:	Kernel	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	hardened-kernel+disabled, kernel
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=59de2bebabc5027f93df999d59cc65df591c3e6e
Whiteboard:	[linux <2.6.27.22] [linux >=2.6.28 <2.6.28.10] [linux >=2.6.29 <2.6.29.2]
Package list:		Runtime testing required:	---

Description Robert Buchholz (RETIRED) gentoo-dev

2009-05-18 17:33:21 UTC

CVE-2009-1192 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1192):
  drivers/char/agp/generic.c in the agp subsystem in the Linux kernel
  before 2.6.30-rc3 does not zero out pages that may later be available
  to a user-space process, which allows local users to obtain sensitive
  information by reading these pages.