CVE-2012-2390: Medium severity linux kernel vulnerability
Description of problem: When called for anonymous (non-shared) mappings, hugetlbreservepages() does a resvmapalloc(). It depends on code in hugetlbfs's vmops->close() to release that allocation.
However, in the mmap() failure path, we do a plain unmapregion() without the removevma() which actually calls vmops->close().
An unprivileged local user could use this flaw to crash the system.
References: http://www.spinics.net/lists/linux-mm/msg34763.html
Proposed upstream fix: https://lkml.org/lkml/2012/5/21/385
Other sources
Memory leak in mm/hugetlb.c in the Linux kernel before 3.4.2 allows local users to cause a denial of service (memory consumption or system crash) via invalid MAPHUGETLB mmap operations.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2390?
CVE-2012-2390 is considered a high severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2012-2390?
To fix CVE-2012-2390, update your Linux kernel to version 5.10.223-1 or later, such as 6.1.119-1.
Which Linux kernel versions are affected by CVE-2012-2390?
CVE-2012-2390 affects Linux kernel versions up to and including 3.4.1.
What type of vulnerability is CVE-2012-2390?
CVE-2012-2390 is a memory management vulnerability that can allow for resource exhaustion.
Can CVE-2012-2390 be exploited remotely?
CVE-2012-2390 does not appear to be directly exploitable remotely, but it can lead to denial of service in local scenarios.