Bug 440786

Summary:	Kernel : "compat_put_timeval()" Argument Passing Weakness (CVE-2012-4467)
Product:	Gentoo Security	Reporter:	Agostino Sarubbo <ago>
Component:	Kernel	Assignee:	Gentoo Kernel Security <security-kernel>
Status:	RESOLVED OBSOLETE
Severity:	normal	CC:	kernel
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description Agostino Sarubbo gentoo-dev

2012-11-01 17:13:54 UTC

From https://secunia.com/advisories/50790/ :

Description
A weakness has been reported in Linux Kernel, which can be exploited by malicious, local users to 
disclose system information and cause a DoS (Denial of Service).

The weakness is caused due to an error in net/socket.c when calling the "compat_put_timeval()" 
function, which incorrectly passes arguments resulting in kernel memory disclosure or system crash.

Successful exploitation may require an architecture that uses a separate address space for user and 
kernel area (e.g. PA-RISC).


Solution
Fixed in the source code repository.

Provided and/or discovered by
Mikulas Patocka, Red Hat.

Original Advisory
http://seclists.org/oss-sec/2012/q4/14

Comment 1 Aaron Bauman (RETIRED) gentoo-dev

2018-04-04 18:15:15 UTC

There are no longer any 2.x or <3.5.4 kernels available in the repository with the exception of sys-kernel/xbox-sources which is unsupported by security.