Bug 291905 (CVE-2009-3624)

Summary:	Kernel: get_instantiation_keyring() DoS (CVE-2009-3624)
Product:	Gentoo Security	Reporter:	Alex Legler (RETIRED) <a3li>
Component:	Kernel	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	hardened-kernel+disabled, kernel
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=21279cfa107af07ef985539ac0de2152b9cba5f5
Whiteboard:	[linux <2.6.31.6] [gp <2.6.31-7]
Package list:		Runtime testing required:	---

Description Alex Legler (RETIRED) archtester

2009-11-04 20:20:35 UTC

CVE-2009-3624 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3624):
  The get_instantiation_keyring function in security/keys/keyctl.c in
  the KEYS subsystem in the Linux kernel before 2.6.32-rc5 does not
  properly maintain the reference count of a keyring, which allows
  local users to gain privileges or cause a denial of service (OOPS)
  via vectors involving calls to this function without specifying a
  keyring by ID, as demonstrated by a series of keyctl request2 and
  keyctl list commands.