Last updated 24 July 2024

Description of problem: It requires debugfs to be mounted on a local system

$ mount | grep debugfs none on /sys/kernel/debug type debugfs (rw) none on /var/lib/ureadahead/debugfs type debugfs (rw,relatime)

Tested with Ubuntu Maverick 10.04.1 with kernel 2.6.32-24-generic-pae. It's probably not exploitable in any meaningful way, although it produces page fault in kernel mode, and makes subsequent processes opening /sys/kernel/debug/tracing/setftracefilter (or setftracenotrace) unkillable, so it's a little bit of a DoS (or at least, annoyance).

Found via one of Tavis Ormandy's tools, I just quickly analyzed it and provided a testcase.

Acknowledgements:

Red Hat would like to thank Robert Swiecki of Google Security Team for reporting this issue.