Debian Bug report logs - #464953
linux-2.6: mmap() local root exploit

version graph

Package: linux-2.6; Maintainer for linux-2.6 is (unknown);

Reported by: William Pitcock <nenolod@sacredspiral.co.uk>

Date: Sun, 10 Feb 2008 01:33:02 UTC

Severity: critical

Tags: patch, security

Merged with 464945, 465246

Found in versions 2.6.18.dfsg.1-17etch1, 2.6.22-3-generic, 2.6.17-1

Fixed in versions 2.6.24-4, 2.6.18.dfsg.1-18etch1, 2.6.22-6.lenny1

Done: Bastian Blank <waldi@debian.org>

Bug is archived. No further changes may be made.

Full log

Message #9 received at control@bugs.debian.org (full text, mbox, reply):

Received: (at control) by bugs.debian.org; 10 Feb 2008 12:00:36 +0000
From waldi@debian.org Sun Feb 10 12:00:36 2008
X-Spam-Checker-Version: SpamAssassin 3.1.4-bugs.debian.org_2005_01_02 
	(2006-07-26) on rietz.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-10.0 required=4.0 tests=BAYES_00,FROMDEVELOPER,
	HAS_BUG_NUMBER,IMPRONONCABLE_2,MURPHY_DRUGS_REL8,VALID_BTS_CONTROL 
	autolearn=no version=3.1.4-bugs.debian.org_2005_01_02
Return-path: <waldi@debian.org>
Received: from wavehammer.waldi.eu.org ([82.139.201.20])
	by rietz.debian.org with esmtp (Exim 4.63)
	(envelope-from <waldi@debian.org>)
	id 1JOArL-0002RD-Kh; Sun, 10 Feb 2008 12:00:36 +0000
Received: by wavehammer.waldi.eu.org (Postfix, from userid 1000)
	id 5B029540D0; Sun, 10 Feb 2008 13:00:33 +0100 (CET)
Date: Sun, 10 Feb 2008 13:00:33 +0100
From: Bastian Blank <waldi@debian.org>
To: Okulov Vitaliy <vitaliy.okulov@gmail.com>, 464945@bugs.debian.org
Subject: Re: Bug#464945: linux-image-2.6.18-6-686: Exploit for vmsplice work for linux-image-2.18-5-686 (CVE-2008-0009/10)
Message-ID: <20080210120033.GB18264@wavehammer.waldi.eu.org>
References: <20080210001920.12161.51480.reportbug@doktor>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="wzJLGUyc3ArbnUjN"
Content-Disposition: inline
In-Reply-To: <20080210001920.12161.51480.reportbug@doktor>
User-Agent: Mutt/1.5.13 (2006-08-11)
Delivered-To: control@bugs.debian.org

[Message part 1 (text/plain, inline)]
tags 464945 patch

On Sun, Feb 10, 2008 at 03:19:20AM +0300, Okulov Vitaliy wrote:
> Just try explot from http://www.milw0rm.com/exploits/5092 at my
> linux-image-2.6.18-5-686 kernel. And it works. Please backport patch
> from 2.6.24.1 kernel (CVE-2008-0009/10).

Preliminary patch, it includes more checks then the update in 2.6.24.1.

It at least fixes the exploit.

Bastian

[patch (text/plain, attachment)]
[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.

Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Thu Jan 11 23:44:37 2018; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.