Bug 282003 (CVE-2009-2848)

Summary:	Kernel: execve() clone syscall DoS (CVE-2009-2848)
Product:	Gentoo Security	Reporter:	Alex Legler (RETIRED) <a3li>
Component:	Kernel	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	hardened-kernel+disabled, kernel
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9c8a8228d0827e0d91d28527209988f672f97d28
Whiteboard:	[linux <2.6.31]
Package list:		Runtime testing required:	---

Description Alex Legler (RETIRED) archtester

2009-08-19 09:34:29 UTC

CVE-2009-2848 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2848):
  The execve function in unspecified versions of the Linux kernel does
  not clear the current->clear_child_tid pointer, which allows local
  users to cause a denial of service (memory corruption) via a clone
  system call with CLONE_CHILD_SETTID or CLONE_CHILD_CLEARTID enabled,
  which is not properly handled during thread creation and exit.