Bug 679560 (CVE-2019-9213)

Summary:	kernel: virtual address 0 is mappable via privileged write() to /proc/*/mem
Product:	Gentoo Security	Reporter:	Thomas Deutschmann (RETIRED) <whissi>
Component:	Kernel	Assignee:	Gentoo Kernel Security <security-kernel>
Status:	RESOLVED FIXED
Severity:	normal
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://bugs.chromium.org/p/project-zero/issues/detail?id=1792
Whiteboard:
Package list:		Runtime testing required:	---
Bug Depends on:	679558
Bug Blocks:

Description Thomas Deutschmann (RETIRED) gentoo-dev

2019-03-05 23:28:17 UTC

In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task.

Upstream fix: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0a1d52994d440e21def1c2174932410b4f2a98a1

Comment 1 John Helmert III archtester

2022-03-26 01:00:48 UTC

Fix in 4.9.162, 4.14.105, 4.19.27, 4.20.14, 5.0.