CVE-2008-4302: Medium severity linux kernel vulnerability
Description of problem: If addtopagecachelru() fails, the page will not be locked. But splice jumps to an error path that does a page release and unlock, causing a BUG() in unlockpage().
Other sources
fs/splice.c in the splice subsystem in the Linux kernel before 2.6.22.2 does not properly handle a failure of the addtopagecachelru function, and subsequently attempts to unlock a page that was not locked, which allows local users to cause a denial of service (kernel BUG and system crash), as demonstrated by the fio I/O tool.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2008-4302?
CVE-2008-4302 is a vulnerability in the Linux kernel that allows local users to cause a denial of service (kernel bug and system crash).
What is the severity of CVE-2008-4302?
The severity of CVE-2008-4302 is high with a CVSS score of 4.9.
How does CVE-2008-4302 impact Linux kernel versions?
CVE-2008-4302 impacts Linux kernel versions before 2.6.22.2.
How can CVE-2008-4302 be fixed?
To fix CVE-2008-4302, it is recommended to update to Linux kernel version 2.6.22.2 or later.
Where can I find more information about CVE-2008-4302?
You can find more information about CVE-2008-4302 at the following references: [http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.26.y.git;a=commit;h=6a860c979b35469e4d77da781a96bdb2ca05ae64](http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.26.y.git;a=commit;h=6a860c979b35469e4d77da781a96bdb2ca05ae64), [http://www.openwall.com/lists/oss-security/2008/09/16/10](http://www.openwall.com/lists/oss-security/2008/09/16/10), [http://lkml.org/lkml/2007/7/20/168](http://lkml.org/lkml/2007/7/20/168).