REDHAT-BUG-642896: High severity red hat linux vulnerability

Published Oct 14, 2010

Updated

Description of problem: The handling functions for sending and receiving messages, in rdspagecopyuser(), use the unchecked copyuserinatomic functions without any access checks on user-provided pointers. As a result, by passing a kernel address as an iovec base address in recvmsg-style calls, a local user can overwrite arbitrary kernel memory, which can easily be used to escalate privileges to root.

Introduced via 7875e18e (v2.6.30-rc1).

Acknowledgements:

Red Hat would like to thank Dan Rosenberg of Virtual Security Research for reporting this issue.

Affected Software

1 affected component

Red Hat Linux Kernel>2.6.30-rc1

Event History

Oct 14, 2010

Data Sourced

via Red Hat·04:09 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-642896?

The severity of REDHAT-BUG-642896 is considered high due to the risk of exposing kernel memory and potential system compromise.

How do I fix REDHAT-BUG-642896?

To fix REDHAT-BUG-642896, update the Linux Kernel to a version that addresses the improper handling of user-provided pointers.

What are the potential impacts of REDHAT-BUG-642896?

The potential impacts of REDHAT-BUG-642896 include unauthorized access to sensitive kernel memory and potential exploitation by malicious users.

Which versions of Red Hat Linux are affected by REDHAT-BUG-642896?

Red Hat Linux Kernel versions starting from 2.6.30-rc1 are affected by REDHAT-BUG-642896.

Is there a workaround for REDHAT-BUG-642896?

Currently, there is no known workaround for REDHAT-BUG-642896 other than applying the appropriate kernel updates.