CVE-2010-4258

Published: 30 December 2010

The do_exit function in kernel/exit.c in the Linux kernel before 2.6.36.2 does not properly handle a KERNEL_DS get_fs value, which allows local users to bypass intended access_ok restrictions, overwrite arbitrary kernel memory locations, and gain privileges by leveraging a (1) BUG, (2) NULL pointer dereference, or (3) page fault, as demonstrated by vectors involving the clear_child_tid feature and the splice system call.

From the Ubuntu security team

Nelson Elhage discovered that the kernel did not correctly handle process cleanup after triggering a recoverable kernel bug. If a local attacker were able to trigger certain kinds of kernel bugs, they could create a specially crafted process to gain root privileges.

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4258
• http://thread.gmane.org/gmane.comp.security.full-disclosure/76457
• http://blog.nelhage.com/2010/12/cve-2010-4258-from-dos-to-privesc/
• http://openwall.com/lists/oss-security/2010/12/02/3
• https://usn.ubuntu.com/usn/usn-1105-1
• https://usn.ubuntu.com/usn/usn-1111-1
• https://usn.ubuntu.com/usn/usn-1083-1
• https://usn.ubuntu.com/usn/usn-1119-1
• https://usn.ubuntu.com/usn/usn-1054-1
• https://usn.ubuntu.com/usn/usn-1093-1
• https://usn.ubuntu.com/usn/usn-1164-1
• https://usn.ubuntu.com/usn/usn-1167-1
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=659567