huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2008-5700: kernel: enforce a minimum SG_IO timeout
Component: kernel
Severity: Low
Public date: 2008-12-05T00:00:00+00:00

libata in the Linux kernel before 2.6.27.9 does not set minimum timeouts for SG_IO requests, which allows local users to cause a denial of service (Programmed I/O mode on drives) via multiple simultaneous invocations of an unspecified test program.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.28
Upstream repository: https://git.kernel.org/linux/kernel/git/stable/linux-2.6.27.y.git
Upstream fix commit: f2f1fa78a155524b849edf359e42a3001ea652c0
CVE-2008-5702: kernel: watchdog: ib700wdt.c - buffer_underflow bug
Component: kernel
Severity: Low
Public date: 2008-08-21T00:00:00+00:00

Buffer underflow in the ibwdt_ioctl function in drivers/watchdog/ib700wdt.c in the Linux kernel before 2.6.28-rc1 might allow local users to have an unknown impact via a certain /dev/watchdog WDIOC_SETTIMEOUT IOCTL call.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.28
Upstream repository: https://git.kernel.org/linux/kernel/git/stable/linux-2.6.27.y.git
Upstream fix commit: 7c2500f17d65092d93345f3996cf82ebca17e9ff
CVE-2008-5713: kernel: soft lockup occurs when network load is very high
Component: kernel
Severity: Important
Public date: 2008-03-28T00:00:00+00:00

The __qdisc_run function in net/sched/sch_generic.c in the Linux kernel before 2.6.25 on SMP machines allows local users to cause a denial of service (soft lockup) by sending a large amount of network traffic, as demonstrated by multiple simultaneous invocations of the Netperf benchmark application in UDP_STREAM mode.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 2.1, 3, 4, and Red Hat Enterprise MRG.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.25
Upstream repository: https://git.kernel.org/linux/kernel/git/stable/linux-2.6.27.y.git
Upstream fix commit: 2ba2506ca7ca62c56edaa334b0fe61eb5eab6ab0
CVE-2008-7256: kernel: nfsd: fix vm overcommit crash
Component: kernel
Severity: Important
Public date: 2008-10-30T00:00:00+00:00

mm/shmem.c in the Linux kernel before 2.6.28-rc8, when strict overcommit is enabled and CONFIG_SECURITY is disabled, does not properly handle the export of shmemfs objects by knfsd, which allows attackers to cause a denial of service (NULL pointer dereference and knfsd crash) or possibly have unspecified other impact via unknown vectors.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1643.

Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 3, 4 and 5 as they did not include nfs-export support for tmpfs. A future kernel update in Red Hat Enterprise MRG will address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.28
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 1b79cd04fab80be61dcd2732e2423aafde9a4c1c
CVE-2009-0031: kernel: local denial of service in keyctl_join_session_keyring
Component: kernel
Severity: Important
Public date: 2009-01-17T00:00:00+00:00

Memory leak in the keyctl_join_session_keyring function (security/keys/keyctl.c) in Linux kernel 2.6.29-rc2 and earlier allows local users to cause a denial of service (kernel memory consumption) via unknown vectors related to a "missing kfree."


Affected upstream versions: n/a
Fixed upstream versions: v2.6.29
Upstream repository: https://git2.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 0d54ee1c7850a954026deec4cd4885f331da35cc
CVE-2009-0036: libvirt: libvirt_proxy buffer overflow
Component: libvirt
Severity: Moderate
Public date: 2009-01-27T00:00:00+00:00

Buffer overflow in the proxyReadClientSocket function in proxy/libvirt_proxy.c in libvirt_proxy 0.5.1 might allow local users to gain privileges by sending a portion of the header of a virProxyPacket packet, and then sending the remainder of the packet with crafted values in the header, related to use of uninitialized memory in a validation check.


Affected upstream versions: n/a
Upstream repository: https://git.et.redhat.com/libvirt.git
Upstream fix commit: 2bb0657e28
CVE-2009-0065: kernel: sctp: memory overflow when FWD-TSN chunk is received with bad stream ID
Component: kernel
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
Public date: 2008-12-26T00:00:00+00:00

Buffer overflow in net/sctp/sm_statefuns.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.28-git8 allows remote attackers to have an unknown impact via an FWD-TSN (aka FORWARD-TSN) chunk with a large stream ID.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.29
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 9fcb95a105758b81ef0131cd18e2db5149f13e95
CVE-2009-0217: xml-security-1.3.0-1jpp.ep1.*: XMLDsig HMAC-based signatures spoofing and authentication bypass
Component: xml-security-1.3.0-1jpp.ep1.*
Severity: Moderate
Public date: 2009-07-14T00:00:00+00:00

The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.


Affected upstream versions: n/a
Upstream repository: https://git.gnome.org/cgit/xmlsec
Upstream fix commit: 34b349675af9f72eb822837a8772cc1ead7115c7
CVE-2009-0269: kernel: ecryptfs readlink flaw
Component: kernel
Severity: Moderate
Public date: 2008-12-22T00:00:00+00:00

fs/ecryptfs/inode.c in the eCryptfs subsystem in the Linux kernel before 2.6.28.1 allows local users to cause a denial of service (fault or memory corruption), or possibly have unspecified other impact, via a readlink call that results in an error, leading to use of a -1 return value as an array index.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.29
Upstream repository: https://git.kernel.org/linux/kernel/git/stable/linux-2.6.27.y.git
Upstream fix commit: a17d5232de7b53d34229de79ec22f4bb04adb7e4
CVE-2009-0322: kernel: dell_rbu local oops
Component: kernel
Severity: Moderate
Public date: 2009-01-17T00:00:00+00:00

drivers/firmware/dell_rbu.c in the Linux kernel before 2.6.27.13, and 2.6.28.x before 2.6.28.2, allows local users to cause a denial of service (system crash) via a read system call that specifies zero bytes from the (1) image_type or (2) packet_size file in /sys/devices/platform/dell_rbu/.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.29
Upstream repository: https://git.kernel.org/linux/kernel/git/stable/linux-2.6.27.y.git
Upstream fix commit: 81156928f8fe31621e467490b9d441c0285998c3
CVE-2009-0386: gstreamer-plugins-good: heap-based buffer overflow while parsing malformed QuickTime media files via crafted Composition Time To Sample (aka ctts) atom data
Component: gstreamer-plugins-good
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
Public date: 2009-01-22T00:00:00+00:00

Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11 might allow remote attackers to execute arbitrary code via crafted Composition Time To Sample (ctts) atom data in a malformed QuickTime media .mov file.


Affected upstream versions: n/a
Fixed upstream versions: RELEASE-0_10_14
Upstream repository: https://cgit.freedesktop.org/gstreamer/gst-plugins-good
Upstream fix commit: bdc20b9baf13564d9a061343416395f8f9a92b53
CVE-2009-0387: gstreamer-plugins-good: Array index error while parsing malformed QuickTime media files via crafted Sync Sample (aka stss) atom data
Component: gstreamer-plugins-good
Severity: Important
Public date: 2009-01-22T00:00:00+00:00

Array index error in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted Sync Sample (aka stss) atom data in a malformed QuickTime media .mov file, related to "mark keyframes."


Affected upstream versions: n/a
Fixed upstream versions: RELEASE-0_10_14
Upstream repository: https://cgit.freedesktop.org/gstreamer/gst-plugins-good
Upstream fix commit: bdc20b9baf13564d9a061343416395f8f9a92b53
CVE-2009-0397: gstreamer-plugins-good: heap-based buffer overflow while parsing malformed QuickTime media files via crafted Time-to-sample (stss) atom data
Component: gstreamer-plugins-good
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
Public date: 2009-01-22T00:00:00+00:00

Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11, and GStreamer Plug-ins (aka gstreamer-plugins) 0.8.5, might allow remote attackers to execute arbitrary code via crafted Time-to-sample (aka stts) atom data in a malformed QuickTime media .mov file.


Affected upstream versions: n/a
Fixed upstream versions: RELEASE-0_10_14
Upstream repository: https://cgit.freedesktop.org/gstreamer/gst-plugins-good
Upstream fix commit: bdc20b9baf13564d9a061343416395f8f9a92b53
CVE-2009-0586: gstreamer-plugins-base: integer overflow in gst_vorbis_tag_add_coverart()
Component: gstreamer-plugins-base
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2009-03-12T00:00:00+00:00

Integer overflow in the gst_vorbis_tag_add_coverart function (gst-libs/gst/tag/gstvorbistag.c) in vorbistag in gst-plugins-base (aka gstreamer-plugins-base) before 0.10.23 in GStreamer allows context-dependent attackers to execute arbitrary code via a crafted COVERART tag that is converted from a base64 representation, which triggers a heap-based buffer overflow.


Affected upstream versions: n/a
Fixed upstream versions: RELEASE-0.10.23
Upstream repository: https://cgit.freedesktop.org/gstreamer/gst-plugins-base
Upstream fix commit: 566583e87147f774e7fc4c78b5f7e61d427e40a9
CVE-2009-0675: kernel: skfp_ioctl inverted logic flaw
Component: kernel
Severity: Moderate
Public date: 2009-01-28T00:00:00+00:00

The skfp_ioctl function in drivers/net/skfp/skfddi.c in the Linux kernel before 2.6.28.6 permits SKFP_CLR_STATS requests only when the CAP_NET_ADMIN capability is absent, instead of when this capability is present, which allows local users to reset the driver statistics, related to an "inverted logic" issue.

Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 4 as the affected driver is not enabled in these kernels by default. The affected driver is enabled by default in Red Hat Enterprise Linux 2.1, 3, 5, and Red Hat Enterprise MRG.

As Red Hat Enterprise Linux 2.1 and 3 are now in Production 3 of their maintenance life-cycle, https://access.redhat.com/support/policy/updates/errata, and this issue has been rated as having moderate impact, the fix for this issue is not currently planned to be included in the future updates.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.29
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: c25b9abbc2c2c0da88e180c3933d6e773245815a
CVE-2009-0676: kernel: memory disclosure in SO_BSDCOMPAT gsopt
Component: kernel
Severity: Moderate
Public date: 2009-02-11T00:00:00+00:00

The sock_getsockopt function in net/core/sock.c in the Linux kernel before 2.6.28.6 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel memory via an SO_BSDCOMPAT getsockopt request.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.29
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: df0bca049d01c0ee94afb7cd5dfd959541e6c8da
CVE-2009-0745: kernel: ext4: ext4_group_add() missing initialisation issue
Component: kernel
Severity: Low
Public date: 2009-01-11T00:00:00+00:00

The ext4_group_add function in fs/ext4/resize.c in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 does not properly initialize the group descriptor during a resize (aka resize2fs) operation, which might allow local users to cause a denial of service (OOPS) by arranging for crafted values to be present in available memory.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 2.1, 3, 4, and Red Hat Enterprise MRG.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.29
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: fdff73f094e7220602cc3f8959c7230517976412
CVE-2009-0746: kernel: ext4: make_indexed_dir() missing validation
Component: kernel
Severity: Low
Public date: 2009-01-11T00:00:00+00:00

The make_indexed_dir function in fs/ext4/namei.c in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 does not validate a certain rec_len field, which allows local users to cause a denial of service (OOPS) by attempting to mount a crafted ext4 filesystem.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 2.1, 3, 4, and Red Hat Enterprise MRG.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.29
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: e6b8bc09ba2075cd91fbffefcd2778b1a00bd76f
CVE-2009-0747: kernel: ext4: ext4_isize() denial of service
Component: kernel
Severity: Low
Public date: 2009-01-07T00:00:00+00:00

The ext4_isize function in fs/ext4/ext4.h in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 uses the i_size_high structure member during operations on arbitrary types of files, which allows local users to cause a denial of service (CPU consumption and error-message flood) by attempting to mount a crafted ext4 filesystem.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 2.1, 3, 4, and Red Hat Enterprise MRG.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.29
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 06a279d636734da32bb62dd2f7b0ade666f65d7c
CVE-2009-0748: kernel: ext4: ext4_fill_super() missing validation issue
Component: kernel
Severity: Low
Public date: 2009-01-06T00:00:00+00:00

The ext4_fill_super function in fs/ext4/super.c in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 does not validate the superblock configuration, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) by attempting to mount a crafted ext4 filesystem.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 2.1, 3, 4, and Red Hat Enterprise MRG.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.29
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 4ec110281379826c5cf6ed14735e47027c3c5765
CVE-2009-0778: kernel: rt_cache leak leads to lack of network connectivity
Component: kernel
Severity: Important
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
Public date: 2008-03-26T00:00:00+00:00

The icmp_send function in net/ipv4/icmp.c in the Linux kernel before 2.6.25, when configured as a router with a REJECT route, does not properly manage the Protocol Independent Destination Cache (aka DST) in some situations involving transmission of an ICMP Host Unreachable message, which allows remote attackers to cause a denial of service (connectivity outage) by sending a large series of packets to many destination IP addresses within this REJECT route, related to an "rt_cache leak."

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 2.1, 3, 4, and Red Hat Enterprise MRG.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.25
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 7c0ecc4c4f8fd90988aab8a95297b9c0038b6160
CVE-2009-0787: kernel: ecryptfs file header infoleak
Component: kernel
Severity: Moderate
Public date: 2009-03-23T00:00:00+00:00

The ecryptfs_write_metadata_to_contents function in the eCryptfs functionality in the Linux kernel 2.6.28 before 2.6.28.9 uses an incorrect size when writing kernel memory to an eCryptfs file header, which triggers an out-of-bounds read and allows local users to obtain portions of kernel memory.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 2.1, 3, 4, and Red Hat Enterprise MRG.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.29
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 8faece5f906725c10e7a1f6caf84452abadbdc7b
CVE-2009-0834: kernel: x86-64: syscall-audit: 32/64 syscall hole
Component: kernel
Severity: Important
Public date: 2009-02-27T00:00:00+00:00

The audit_syscall_entry function in the Linux kernel 2.6.28.7 and earlier on the x86_64 platform does not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass certain syscall audit configurations via crafted syscalls, a related issue to CVE-2009-0342 and CVE-2009-0343.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.29
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: ccbe495caa5e604b04d5a31d7459a6f6a76a756c
CVE-2009-0946: freetype: multiple integer overflows
Component: freetype
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2009-03-20T00:00:00+00:00

Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3) cff/cffload.c.


Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/freetype/freetype2.git
Upstream fix commit: a18788b14db60ae3673f932249cd02d33a227c4e
CVE-2009-1072: kernel: nfsd should drop CAP_MKNOD for non-root
Component: kernel
Severity: Moderate
Public date: 2009-03-19T00:00:00+00:00

nfsd in the Linux kernel before 2.6.28.9 does not drop the CAP_MKNOD capability before handling a user request in a thread, which allows local users to create device nodes, as demonstrated on a filesystem that has been exported with the root_squash option.

Statement: This issue is not planned to be fixed in Red Hat Enterprise Linux 2.1 and 3, due to these products being in Production 3 of their maintenance life-cycles, where only qualified security errata of important or critical impact are addressed.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.29
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 76a67ec6fb79ff3570dcb5342142c16098299911
CVE-2009-1185: udev: Uncheck origin of NETLINK messages
Component: udev
Severity: Important
CWE: CWE-862 (Missing Authorization)
Public date: 2009-04-15T00:00:00+00:00

udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space.

Statement: udev packages as shipped in Red Hat Enterprise Linux 4 are not affected by this flaw, as they do not use netlink sockets for communication. udev is not shipped in Red Hat Enterprise Linux 2.1 and 3.

Affected upstream versions: n/a
Upstream repository: https://git.kernel.org/linux/hotplug/udev.git
Upstream fix commit: e2b362d9f23d4c63018709ab5f81a02f72b91e75
CVE-2009-1192: kernel: agp: zero pages before sending to userspace
Component: kernel
Severity: Low
Public date: 2009-04-20T00:00:00+00:00

The (1) agp_generic_alloc_page and (2) agp_generic_alloc_pages functions in drivers/char/agp/generic.c in the agp subsystem in the Linux kernel before 2.6.30-rc3 do not zero out pages that may later be available to a user-space process, which allows local users to obtain sensitive information by reading these pages.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.30
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 59de2bebabc5027f93df999d59cc65df591c3e6e
CVE-2009-1194: pango: pango_glyph_string_set_size integer overflow
Component: pango
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2009-05-07T00:00:00+00:00

Integer overflow in the pango_glyph_string_set_size function in pango/glyphstring.c in Pango before 1.24 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long glyph string that triggers a heap-based buffer overflow, as demonstrated by a long document.location value in Firefox.


Affected upstream versions: n/a
Upstream repository: https://github.com/bratsche/pango
Upstream fix commit: 4de30e5500eaeb49f4bf0b7a07f718e149a2ed5e
CVE-2009-1336: kernel: nfsv4 client can be crashed by stating a long filename
Component: kernel
Severity: Moderate
Public date: 2007-09-28T00:00:00+00:00

fs/nfs/client.c in the Linux kernel before 2.6.23 does not properly initialize a certain structure member that stores the maximum NFS filename length, which allows local users to cause a denial of service (OOPS) via a long filename, related to the encode_lookup function.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.23
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 54af3bb543c071769141387a42deaaab5074da55
CVE-2009-1337: kernel: exit_notify: kill the wrong capable(CAP_KILL) check
Component: kernel
Severity: Important
Public date: 2009-02-25T00:00:00+00:00

The exit_notify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAP_KILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exit_signal field and then uses an exec system call to launch a setuid application.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.30
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 432870dab85a2f69dc417022646cb9a70acf7f94
CVE-2009-1338: kernel: 'kill sig -1' must only apply to caller's pid namespace
Component: kernel
Severity: Moderate
Public date: 2008-10-29T00:00:00+00:00

The kill_something_info function in kernel/signal.c in the Linux kernel before 2.6.28 does not consider PID namespaces when processing signals directed to PID -1, which allows local users to bypass the intended namespace isolation, and send arbitrary signals to all processes in all namespaces, via a kill command.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 2.1, 3, 4, and 5.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.28
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: d25141a818383b3c3b09f065698c544a7a0ec6e7