CVE-2010-4258

The do_exit function in kernel/exit.c in the Linux kernel before 2.6.36.2 does not properly handle a KERNEL_DS get_fs value, which allows local users to bypass intended access_ok restrictions, overwrite arbitrary kernel memory locations, and gain privileges by leveraging a (1) BUG, (2) NULL pointer dereference, or (3) page fault, as demonstrated by vectors involving the clear_child_tid feature and the splice system call.

From the Ubuntu Security Team

Nelson Elhage discovered that the kernel did not correctly handle process cleanup after triggering a recoverable kernel bug. If a local attacker were able to trigger certain kinds of kernel bugs, they could create a specially crafted process to gain root privileges.

• How can I get the fixes?
• What do statuses mean?
• Patch details

References

• MITRE
• NVD
• Launchpad
• Debian

Related Ubuntu Security Notices (USN)

• USN-1164-1
• Linux kernel vulnerabilities (i.MX51)
• 6 July 2011
• USN-1105-1
• Linux kernel vulnerabilities
• 5 April 2011
• USN-1083-1
• Linux kernel vulnerabilities
• 3 March 2011
• USN-1054-1
• Linux kernel vulnerabilities
• 1 February 2011
• USN-1111-1
• Linux kernel vulnerabilities
• 5 May 2011
• USN-1119-1
• Linux kernel (OMAP4) vulnerabilities
• 20 April 2011
• USN-1093-1
• Linux Kernel vulnerabilities (Marvell Dove)
• 25 March 2011

Other references

• http://thread.gmane.org/gmane.comp.security.full-disclosure/76457
• http://blog.nelhage.com/2010/12/cve-2010-4258-from-dos-to-privesc/
• http://openwall.com/lists/oss-security/2010/12/02/3
• https://www.cve.org/CVERecord?id=CVE-2010-4258