Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 202755 - sys-kernel/*-sources <2.6.23.X possible data leak or DoS in shmem_getpage (CVE-2007-6417)
Summary: sys-kernel/*-sources <2.6.23.X possible data leak or DoS in shmem_getpage (CV...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Kernel (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
URL: http://marc.info/?t=119627682600002&r...
Whiteboard: [linux < 2.6.16.58][linux >= 2.6.17 <...
Keywords:
Depends on:
Blocks:
 
Reported: 2007-12-19 08:45 UTC by Lars Hartmann
Modified: 2013-09-12 04:56 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Lars Hartmann 2007-12-19 08:45:39 UTC 
The shmem_getpage function (mm/shmem.c) in Linux kernel 2.6.11 through 2.6.23 does not properly allocate memory in some circumstances, which might allow local users to read sensitive kernel data or cause a denial of service (crash).
Solution:
apply patch: http://marc.info/?l=linux-kernel&m=119627664702379&w=2

Reproducible: Always
Comment 1 Mike Pagano gentoo-dev 2007-12-19 14:58:54 UTC 
This patch is included in gentoo-sources-2.6.23-r4
Comment 2 unnamedrambler 2008-03-21 19:26:48 UTC 
[linux < 2.6.16.58] d808e724a4f4b8531c7fb8722e0e60100b3cb1c2
[linux >= 2.6.17 < 2.6.22.15] 85059cfa96a91cbe88ea3b7acb4c255684972cc4
[linux >= 2.6.23 < 2.6.23.10] 831ac1f2cd32ee3271cca477705f823947233ec3
also 2.6.24 e84e2e132c9c66d8498e7710d4ea532d1feaaac5

[gp < 2.6.23-5]
Comment 3 svrmarty 2009-08-05 15:57:04 UTC 
latest update from 2008

please close