Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 459266 (CVE-2013-1767) - Kernel : tmpfs: fix use-after-free of mempolicy object (CVE-2013-1767)
Summary: Kernel : tmpfs: fix use-after-free of mempolicy object (CVE-2013-1767)
Status: RESOLVED OBSOLETE
Alias: CVE-2013-1767
Product: Gentoo Security
Classification: Unclassified
Component: Kernel (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Kernel Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-02-26 09:42 UTC by Agostino Sarubbo
Modified: 2018-04-04 18:35 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2013-02-26 09:42:21 UTC
From $URL :

Linux kernel built with support to `tmpfs' is vulnerable to a use-after-free flaw, which happens while remounting tmpfs, which was mounted with mpol=M option initially, but 
the same is missing in the remount request.

This flaw could be used to cause kernel crash by unprivileged user, considering a latest commit[2] enables the user to do so.

Upstream fix:
-------------
 -> http://git.zx2c4.com/linux/commit/?id=5f00110f7273f9ff04ac69a5f85bb535a4fd0987

References:
-----------
1] http://www.openwall.com/lists/oss-security/2013/02/25/14
2] http://git.zx2c4.com/linux/commit/?id=5eaf563e53294d6696e651466697eb9d491f3946
Comment 1 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2018-04-04 18:35:56 UTC
There are no longer any 2.x or <3.7.10 kernels available in the repository with the exception of sys-kernel/xbox-sources which is unsupported by security.