CVE-2010-0622

First published: Tue Feb 09 2010(Updated: )

Description of problem: If the owner of a PI futex dies we fix up the pi_state and set pi_state-&gt;owner to NULL. When a malicious or just sloppy programmed user space application sets the futex value to 0 e.g. by calling pthread_mutex_init(), then the futex can be acquired again. A new waiter manages to enqueue itself on the pi_state w/o damage, but on unlock the kernel dereferences pi_state-&gt;owner and oopses. Prevent this by checking pi_state-&gt;owner in the unlock path. If pi_state-&gt;owner is not current we know that user space manipulated the futex value. Ignore the mess and return -EINVAL. This catches the above case and also the case where a task hijacks the futex by setting the tid value and then tries to unlock it. Upstream commit: <a href="http://git.kernel.org/linus/51246bfd189064079c54421507236fd2723b18f3">http://git.kernel.org/linus/51246bfd189064079c54421507236fd2723b18f3</a> Note that pi-futex was introduced in: <a href="http://git.kernel.org/linus/c87e2837be82df479a6bae9f155c43516d2feebc">http://git.kernel.org/linus/c87e2837be82df479a6bae9f155c43516d2feebc</a>

Credit: cve@mitre.org cve@mitre.org

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/nvd-historical
• collector/nvd-index
• collector/nvd-api
• agent/author
• agent/type
• agent/softwarecombine
• agent/first-publish-date
• collector/mitre-cve
• source/MITRE
• agent/references
• agent/weakness
• agent/remedy
• agent/severity
• agent/last-modified-date
• agent/description
• agent/tags
• agent/event
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2010-0622
• vendor/linux
• canonical/linux linux kernel
• version/linux linux kernel/2.6.11
• version/linux linux kernel/2.6.23.4
• version/linux linux kernel/2.6.16.16
• version/linux linux kernel/2.6.18.7
• version/linux linux kernel/2.6.17.12
• version/linux linux kernel/2.6.16.9
• version/linux linux kernel/2.6.17.9
• version/linux linux kernel/2.6.11.2
• version/linux linux kernel/2.6.5
• version/linux linux kernel/2.6.15.3
• version/linux linux kernel/2.6.11.10
• version/linux linux kernel/2.6.1
• version/linux linux kernel/2.6.16.6
• version/linux linux kernel/2.6.16.8
• version/linux linux kernel/2.6.22.4
• version/linux linux kernel/2.6.14.7
• version/linux linux kernel/2.6.13
• version/linux linux kernel/2.6.17.2
• version/linux linux kernel/2.6.13.3
• version/linux linux kernel/2.6.11.8
• version/linux linux kernel/2.6.23.7
• version/linux linux kernel/2.6.17.8
• version/linux linux kernel/2.6.14.4
• version/linux linux kernel/2.6.14
• version/linux linux kernel/2.6.17.4
• version/linux linux kernel/2.6.16.18
• version/linux linux kernel/2.6.17.14
• version/linux linux kernel/2.6.10
• version/linux linux kernel/2.6.14.3
• version/linux linux kernel/2.6.24-rc3
• version/linux linux kernel/2.6.18.3
• version/linux linux kernel/2.6.11.6
• version/linux linux kernel/2.6.11.11
• version/linux linux kernel/2.6.16.13
• version/linux linux kernel/2.6.3
• version/linux linux kernel/2.6.32
• version/linux linux kernel/2.6.16.4
• version/linux linux kernel/2.6.17.3
• version/linux linux kernel/2.6.32.3
• version/linux linux kernel/2.6.22
• version/linux linux kernel/2.6.4
• version/linux linux kernel/2.6.16.15
• version/linux linux kernel/2.6.15.6
• version/linux linux kernel/2.6.24-rc5
• version/linux linux kernel/2.6.15.1
• version/linux linux kernel/2.6.11.5
• version/linux linux kernel/2.6.18.4
• version/linux linux kernel/2.6.33-rc1
• version/linux linux kernel/2.6.16.1
• version/linux linux kernel/2.6.18.1
• version/linux linux kernel/2.6.23.1
• version/linux linux kernel/2.6.2
• version/linux linux kernel/2.6.14.5
• version/linux linux kernel/2.6.13.2
• version/linux linux kernel/2.6.17.5
• version/linux linux kernel/2.6.24-rc4
• version/linux linux kernel/2.6.18.5
• version/linux linux kernel/2.6.13.5
• version/linux linux kernel/2.6.17
• version/linux linux kernel/2.6.16.11
• version/linux linux kernel/2.6.16.14
• version/linux linux kernel/2.6.33
• version/linux linux kernel/2.6.33-rc2
• version/linux linux kernel/2.6.16.25
• version/linux linux kernel/2.6.16.21
• version/linux linux kernel/2.6.8
• version/linux linux kernel/2.6.16.28
• version/linux linux kernel/2.6.17.10
• version/linux linux kernel/2.6.14.1
• version/linux linux kernel/2.6.16.23
• version/linux linux kernel/2.6.12.5
• version/linux linux kernel/2.6.15.7
• version/linux linux kernel/2.6.22.7
• version/linux linux kernel/2.6.16.3
• version/linux linux kernel/2.6.24-rc1
• version/linux linux kernel/2.6.14.6
• version/linux linux kernel/2.6.12.1
• version/linux linux kernel/2.6.11.9
• version/linux linux kernel/2.6.17.1
• version/linux linux kernel/2.6.0
• version/linux linux kernel/2.6.13.4
• version/linux linux kernel/2.6.23-rc2
• version/linux linux kernel/2.6.22.6
• version/linux linux kernel/2.6.23.3
• version/linux linux kernel/2.6.18.8
• version/linux linux kernel/2.6.22.3
• version/linux linux kernel/2.6.12.2
• version/linux linux kernel/2.6.16.31
• version/linux linux kernel/2.6.16.26
• version/linux linux kernel/2.6.18.2
• version/linux linux kernel/2.6.16.29
• version/linux linux kernel/2.6.23-rc1
• version/linux linux kernel/2.6.16
• version/linux linux kernel/2.6.15.2
• version/linux linux kernel/2.6.16.22
• version/linux linux kernel/2.6.17.11
• version/linux linux kernel/2.6.16.10
• version/linux linux kernel/2.6.12.4
• version/linux linux kernel/2.6.11.3
• version/linux linux kernel/2.6.16.24
• version/linux linux kernel/2.6.23
• version/linux linux kernel/2.6.12.3
• version/linux linux kernel/2.6.23.2
• version/linux linux kernel/2.6.7
• version/linux linux kernel/2.6.32.4
• version/linux linux kernel/2.6.16.30
• version/linux linux kernel/2.6.15.4
• version/linux linux kernel/2.6.24-rc2
• version/linux linux kernel/2.6.16.17
• version/linux linux kernel/2.6.16.12
• version/linux linux kernel/2.6.16.27
• version/linux linux kernel/2.6.12.6
• version/linux linux kernel/2.6.17.7
• version/linux linux kernel/2.6.11.7
• version/linux linux kernel/2.6.16.2
• version/linux linux kernel/2.6.18.6
• version/linux linux kernel/2.6.15
• version/linux linux kernel/2.6.33-rc4
• version/linux linux kernel/2.6.23.5
• version/linux linux kernel/2.6.32.2
• version/linux linux kernel/2.6.17.6
• version/linux linux kernel/2.6.23.6
• version/linux linux kernel/2.6.16.7
• version/linux linux kernel/2.6.32.1
• version/linux linux kernel/2.6.17.13
• version/linux linux kernel/2.6.22.2
• version/linux linux kernel/2.6.8.1
• version/linux linux kernel/2.6.22.5
• version/linux linux kernel/2.6.16.5
• version/linux linux kernel/2.6.11.4
• version/linux linux kernel/2.6.16.19
• version/linux linux kernel/2.6.11.12
• version/linux linux kernel/2.6.16.20
• version/linux linux kernel/2.6.15.5
• version/linux linux kernel/2.6.11.1
• version/linux linux kernel/2.6.33-rc5
• version/linux linux kernel/2.6.9
• version/linux linux kernel/2.6.13.1
• version/linux linux kernel/2.6.6
• version/linux linux kernel/2.6.12