CVE-2008-2372: Input Validation
Published Jul 2, 2008
·Updated
The Linux kernel 2.6.24 and 2.6.25 before 2.6.25.9 allows local users to cause a denial of service (memory consumption) via a large number of calls to the getuserpages function, which lacks a ZEROPAGE optimization and results in allocation of "useless newly zeroed pages."
Affected Software
10 affected components
Linux Linux kernel=2.6.25.5
Linux Linux kernel=2.6.25.3
Linux Linux kernel=2.6.24
Linux Linux kernel=2.6.25.8
Linux Linux kernel=2.6.25.1
Linux Linux kernel=2.6.25.4
Linux Linux kernel=2.6.25
Linux Linux kernel=2.6.25.2
Linux Linux kernel=2.6.25.7
Linux Linux kernel=2.6.25.6
Event History
Jul 2, 2008
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
Who can exploit this issue?
A local user can trigger the denial of service. The issue does not require authentication according to the provided vector.
2
What is the impact of successful exploitation?
Repeated calls to get_user_pages can consume memory by allocating unnecessary newly zeroed pages, potentially causing a denial of service.
3
Which kernel versions are affected?
Linux kernel 2.6.24 and 2.6.25 releases before 2.6.25.9 are affected. Version 2.6.25.9 is identified as the boundary after which the issue is fixed.