679560 – (CVE-2019-9213) kernel: virtual address 0 is mappable via privileged write() to /proc/*/mem

Bug 679560 (CVE-2019-9213) - kernel: virtual address 0 is mappable via privileged write() to /proc/*/mem

Summary: kernel: virtual address 0 is mappable via privileged write() to /proc/*/mem

Status:	RESOLVED FIXED

Alias:	CVE-2019-9213

Product:	Gentoo Security
Classification:	Unclassified
Component:	Kernel (show other bugs)
Hardware:	All Linux

Importance:	Normal normal (vote)
Assignee:	Gentoo Kernel Security

URL:	https://bugs.chromium.org/p/project-z...
Whiteboard:
Keywords:

Depends on:	679558
Blocks:
	Show dependency tree

Reported:	2019-03-05 23:28 UTC by Thomas Deutschmann (RETIRED)
Modified:	2022-03-26 01:00 UTC (History)
CC List:	0 users

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Thomas Deutschmann (RETIRED) gentoo-dev

2019-03-05 23:28:17 UTC

In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task.

Upstream fix: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0a1d52994d440e21def1c2174932410b4f2a98a1

Comment 1 John Helmert III archtester

2022-03-26 01:00:48 UTC

Fix in 4.9.162, 4.14.105, 4.19.27, 4.20.14, 5.0.