CVE-2012-0879

Published: 23 February 2012

The I/O implementation for block devices in the Linux kernel before 2.6.33 does not properly handle the CLONE_IO feature, which allows local users to cause a denial of service (I/O instability) by starting multiple processes that share an I/O context.

From the Ubuntu security team

Louis Rilling discovered a flaw in Linux kernel's clone command when CLONE_IO is specified. An unprivileged local user could exploit this to cause a denial of service.

Priority

Low

CVSS 3 base score: 5.5

Status

Notes

per Petr Matousek, "Looks like it got fixed in Linux kernel 2.6.33(-rc1)"

CLONE_IO was introduced by the commit below, the bug cannot have
existed before then:
fadad878cc0640cc9cd5569998bf54b693f7b38b

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0879
• http://www.openwall.com/lists/oss-security/2012/02/23/5
• http://comments.gmane.org/gmane.linux.kernel/922519
• https://ubuntu.com/security/notices/USN-1389-1
• https://ubuntu.com/security/notices/USN-1411-1
• https://ubuntu.com/security/notices/USN-1408-1
• https://ubuntu.com/security/notices/USN-1410-1
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=796829
• https://launchpad.net/bugs/940743