Bug 277368 (CVE-2009-1388)

Summary:	Kernel: ptrace_start() vs do_coredump() deadlock (CVE-2009-1388)
Product:	Gentoo Security	Reporter:	Stefan Behte (RETIRED) <craig>
Component:	Kernel	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	kernel
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://bugzilla.redhat.com/show_bug.cgi?id=504263
Whiteboard:	[linux <2.6.19]
Package list:		Runtime testing required:	---

Description Stefan Behte (RETIRED) gentoo-dev

2009-07-10 22:58:54 UTC

CVE-2009-1388 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1388):
  The ptrace_start function in kernel/ptrace.c in the Linux kernel
  2.6.18 does not properly handle simultaneous execution of the
  do_coredump function, which allows local users to cause a denial of
  service (deadlock) via vectors involving the ptrace system call and a
  coredumping thread.

Comment 1 Robert Buchholz (RETIRED) gentoo-dev

2009-07-13 13:39:25 UTC

probably affects all 2.6.18 based kernels, not just the .18 base