CVE-2010-0622: Low severity Linux Linux kernel vulnerability
Description of problem: If the owner of a PI futex dies we fix up the pistate and set pistate->owner to NULL. When a malicious or just sloppy programmed user space application sets the futex value to 0 e.g. by calling pthreadmutexinit(), then the futex can be acquired again. A new waiter manages to enqueue itself on the pistate w/o damage, but on unlock the kernel dereferences pistate->owner and oopses. Prevent this by checking pistate->owner in the unlock path. If pistate->owner is not current we know that user space manipulated the futex value. Ignore the mess and return -EINVAL. This catches the above case and also the case where a task hijacks the futex by setting the tid value and then tries to unlock it.
Upstream commit: http://git.kernel.org/linus/51246bfd189064079c54421507236fd2723b18f3
Note that pi-futex was introduced in: http://git.kernel.org/linus/c87e2837be82df479a6bae9f155c43516d2feebc
Other sources
The wakefutexpi function in kernel/futex.c in the Linux kernel before 2.6.33-rc7 does not properly handle certain unlock operations for a Priority Inheritance (PI) futex, which allows local users to cause a denial of service (OOPS) and possibly have unspecified other impact via vectors involving modification of the futex value from user space.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0622?
CVE-2010-0622 is classified as a high severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2010-0622?
To fix CVE-2010-0622, it is recommended to upgrade to a patched version of the Linux Kernel that is greater than 2.6.33.
What systems are affected by CVE-2010-0622?
CVE-2010-0622 affects various versions of the Linux Kernel up to 2.6.33.
Can CVE-2010-0622 be exploited remotely?
CVE-2010-0622 requires local access to exploit, therefore it cannot be exploited remotely.
What type of vulnerability is CVE-2010-0622?
CVE-2010-0622 is a privilege escalation vulnerability relating to the handling of futexes in the Linux Kernel.