CVE-2009-4895
Published: 8 September 2010
Race condition in the tty_fasync function in drivers/char/tty_io.c in the Linux kernel before 2.6.32.6 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via unknown vectors, related to the put_tty_queue and __f_setown functions. NOTE: the vulnerability was addressed in a different way in 2.6.32.9.
From the Ubuntu Security Team
Al Viro discovered a race condition in the TTY driver. A local attacker could exploit this to crash the system, leading to a denial of service.
Notes
| Author | Note |
|---|---|
| sbeattie |
first patch (703625118069f9f8) was reverted and the second patch was used in 2.6.32.9, which fixes the issue "properly". |
| smb |
IMO the races in tty became visible when the BLK was pushed down into the line disciplines and switch to unlocked ioctl in 2.6.26 (04f378b198da233ca0aca341b113dc6579d46123), so Hardy and Dapper are not affected. |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
linux
Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
| hardy |
Not vulnerable
|
|
| jaunty |
Released
(2.6.28-19.66)
|
|
| karmic |
Released
(2.6.31-22.67)
|
|
| lucid |
Not vulnerable
(2.6.32-15.21)
|
|
| maverick |
Not vulnerable
(2.6.35)
|
|
| upstream |
Released
(2.6.33-rc8, 2.6.32.9, 2.6.27.46)
|
|
|
Patches:
upstream: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=703625118069f9f8960d356676662d3db5a9d116 upstream: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=80e1e823989ec44d8e35bdfddadbddcffec90424 jaunty: http://chinstrap.ubuntu.com/~smb/CVEs/CVE-2009-4895/patches/jaunty/linux/0001-Fix-race-in-tty_fasync-properly.txt karmic: http://chinstrap.ubuntu.com/~smb/CVEs/CVE-2009-4895/patches/karmic/linux/0001-Fix-race-in-tty_fasync-properly.txt |
||
|
linux-ec2
Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
| hardy |
Does not exist
|
|
| karmic |
Released
(2.6.31-307.21)
|
|
| lucid |
Released
(2.6.32-309.18)
|
|
| maverick |
Ignored
(end of life)
|
|
| upstream |
Needs triage
|
|
|
linux-fsl-imx51
Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
| hardy |
Does not exist
|
|
| karmic |
Released
(2.6.31-112.30)
|
|
| lucid |
Released
(2.6.31-608.22)
|
|
| maverick |
Does not exist
|
|
| upstream |
Needs triage
|
|
|
linux-lts-backport-maverick
Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
| hardy |
Does not exist
|
|
| karmic |
Does not exist
|
|
| lucid |
Released
(2.6.35-25.44~lucid1)
|
|
| maverick |
Does not exist
|
|
| upstream |
Needs triage
|
|
|
linux-source-2.6.15
Launchpad, Ubuntu, Debian |
dapper |
Not vulnerable
|
| hardy |
Does not exist
|
|
| jaunty |
Does not exist
|
|
| karmic |
Does not exist
|
|
| lucid |
Does not exist
|
|
| maverick |
Does not exist
|
|
| upstream |
Not vulnerable
|
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 4.7 |
| Attack vector | Local |
| Attack complexity | High |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H |