Last updated 6 February 2025
Integer overflow in the fbmmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the Motochopper pwn program.
A flaw was found in the way index into perfsweventenabled array was sanitized.
A local unprivileged user can use this flaw to increase their privileges on the system.
Introduced by: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b0a873ebbf87bf38bf70b5e39a7cadc96099fa13
Upstream fix: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8176cced706b5e5d15887584150764894e94e02f
References: http://lkml.indiana.edu/hypermail/linux/kernel/1304.1/03652.html https://news.ycombinator.com/item?id=5703758 http://packetstormsecurity.com/files/121616/semtex.c