Description
The copy_from_user function in the uaccess code in Linux kernel 2.6 before 2.6.19-rc1, when running on s390, does not properly clear a kernel buffer, which allows local user space programs to read portions of kernel memory by "appending to a file from a bad address," which triggers a fault that prevents the unused memory from being cleared in the kernel buffer.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://lkml.org/lkml/2006/11/5/46 ↗
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9885 ↗
- http://www.novell.com/linux/security/advisories/2006_79_kernel.html ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/29378 ↗
- http://www.securityfocus.com/bid/20379 ↗
- http://rhn.redhat.com/errata/RHSA-2007-0014.html ↗
- http://www.vupen.com/english/advisories/2006/3938 ↗
- http://support.avaya.com/elmodocs2/security/ASA-2007-063.htm ↗
- http://www.us.debian.org/security/2006/dsa-1237 ↗
- http://secunia.com/advisories/24206 ↗
- http://securitytracker.com/id?1017090 ↗
- http://secunia.com/advisories/23474 ↗
- http://secunia.com/advisories/23064 ↗
- http://www.us.debian.org/security/2006/dsa-1233 ↗
- http://secunia.com/advisories/23370 ↗
- http://secunia.com/advisories/23997 ↗
- http://support.avaya.com/elmodocs2/security/ASA-2006-254.htm ↗
- http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=52149ba6b0ddf3e9d965257cc0513193650b3ea8 ↗
- http://secunia.com/advisories/22497 ↗
- http://www.redhat.com/support/errata/RHSA-2006-0710.html ↗
- http://secunia.com/advisories/23395 ↗
- http://secunia.com/advisories/22289 ↗