CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 6.2
CWE Name:  Permissions Privileges and Access Controls
Summary: the do_exit function in kernel/exit.c in the linux kernel before 2.6.36.2 does not properly handle a kernel_ds get_fs value, which allows local users to bypass intended access_ok restrictions, overwrite arbitrary kernel memory locations, and gain privileges by leveraging a (1) bug, (2) null pointer dereference, or (3) page fault, as demonstrated by vectors involving the clear_child_tid feature and the splice system call.
Access Authentication: NONE
Access Complexity: HIGH
Access Vector: LOCAL
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2010-12-30
Last Modified Date: 2013-09-13