CVE-2010-3079: Null Pointer Dereference
Description of problem: It requires debugfs to be mounted on a local system
$ mount | grep debugfs none on /sys/kernel/debug type debugfs (rw) none on /var/lib/ureadahead/debugfs type debugfs (rw,relatime)
Tested with Ubuntu Maverick 10.04.1 with kernel 2.6.32-24-generic-pae. It's probably not exploitable in any meaningful way, although it produces page fault in kernel mode, and makes subsequent processes opening /sys/kernel/debug/tracing/setftracefilter (or setftracenotrace) unkillable, so it's a little bit of a DoS (or at least, annoyance).
Found via one of Tavis Ormandy's tools, I just quickly analyzed it and provided a testcase.
Acknowledgements:
Red Hat would like to thank Robert Swiecki of Google Security Team for reporting this issue.
Other sources
kernel/trace/ftrace.c in the Linux kernel before 2.6.35.5, when debugfs is enabled, does not properly handle interaction between mutex possession and llseek operations, which allows local users to cause a denial of service (NULL pointer dereference and outage of all function tracing files) via an lseek call on a file descriptor associated with the setftracefilter file.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3079?
CVE-2010-3079 is classified as a medium severity vulnerability.
How does CVE-2010-3079 affect users?
CVE-2010-3079 can lead to local privilege escalation if debugfs is mounted.
How do I fix CVE-2010-3079?
To fix CVE-2010-3079, ensure that debugfs is not mounted or update your kernel to a secure version.
Which systems are affected by CVE-2010-3079?
CVE-2010-3079 affects various Linux kernel versions and distributions including Ubuntu and SUSE.
What is the impact of CVE-2010-3079?
The impact of CVE-2010-3079 is the potential for unauthorized access to kernel functionalities by a local user.