CVE-2012-3375
Published: 04 July 2012
The epoll_ctl system call in fs/eventpoll.c in the Linux kernel before 3.2.24 does not properly handle ELOOP errors in EPOLL_CTL_ADD operations, which allows local users to cause a denial of service (file-descriptor consumption and system crash) via a crafted application that attempts to create a circular epoll dependency. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1083.
From the Ubuntu security team
A flaw was discovered in the Linux kernel's epoll system call. An unprivileged local user could use this flaw to crash the system.
Priority
Medium
Status
Notes
| Author | Note |
|---|---|
| jdstrand | linux-armadaxp is maintained by OEM |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3375
- http://www.openwall.com/lists/oss-security/2012/07/04
- https://ubuntu.com/security/notices/USN-1529-1
- https://ubuntu.com/security/notices/USN-1533-1
- https://ubuntu.com/security/notices/USN-1532-1
- https://ubuntu.com/security/notices/USN-1514-1
- https://ubuntu.com/security/notices/USN-1539-1
- NVD
- Launchpad
- Debian