CVE-2011-2183: Null Pointer Dereference
Andrea Righi reported a case where an exiting task can race against ksmd.
ksmscan.mmslot == the only registered mm CPU 1 (bug program) CPU 2 (ksmd) listempty() is false lock ksmscan.mmslot listdel unlock slot == &ksmmmhead (but list is now empty)
Close this race by revalidating that the new slot is not simply the list head again.
Reproducer: http://www.spinics.net/lists/linux-mm/msg20233.html Proposed patch: http://www.spinics.net/lists/linux-mm/msg20301.html
Acknowledgements:
Red Hat would like to thank Andrea Righi for reporting this issue.
Other sources
Race condition in the scangetnextrmapitem function in mm/ksm.c in the Linux kernel before 2.6.39.3, when Kernel SamePage Merging (KSM) is enabled, allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted application.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2183?
CVE-2011-2183 has a medium severity rating due to the potential race condition it introduces.
How do I fix CVE-2011-2183?
To fix CVE-2011-2183, upgrade to a patched version of the Linux kernel that resolves the race condition.
What software versions are affected by CVE-2011-2183?
CVE-2011-2183 affects Linux kernel versions prior to 2.6.39.3.
What is the nature of the vulnerability CVE-2011-2183?
CVE-2011-2183 is a race condition vulnerability that can occur between an exiting task and the Kernel Same-page Merging daemon (ksmd).
How can CVE-2011-2183 impact my system?
If exploited, CVE-2011-2183 could lead to instability or unexpected behavior of the kernel, potentially allowing unauthorized access to system memory.