Description
The do_splice_from function in fs/splice.c in the Linux kernel before 2.6.27 does not reject file descriptors that have the O_APPEND flag set, which allows local users to bypass append mode and make arbitrary changes to other locations in the file.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://secunia.com/advisories/35390 ↗
- http://secunia.com/advisories/32998 ↗
- http://www.openwall.com/lists/oss-security/2008/10/13/1 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=466707 ↗
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:224 ↗
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11142 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45954 ↗
- http://www.securityfocus.com/bid/31903 ↗
- http://www.redhat.com/support/errata/RHSA-2009-0009.html ↗
- http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00000.html ↗
- https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00693.html ↗
- http://www.openwall.com/lists/oss-security/2008/10/14/5 ↗
- http://secunia.com/advisories/33586 ↗
- http://www.debian.org/security/2008/dsa-1687 ↗
- http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.26.y.git%3Ba=commit%3Bh=efc968d450e013049a662d22727cf132618dcb2f ↗
- http://secunia.com/advisories/32918 ↗
- http://www.ubuntu.com/usn/usn-679-1 ↗
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27 ↗
- http://secunia.com/advisories/33180 ↗
- http://www.redhat.com/support/errata/RHSA-2008-1017.html ↗
- http://secunia.com/advisories/32386 ↗
- https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00689.html ↗
- http://www.debian.org/security/2008/dsa-1681 ↗
- http://secunia.com/advisories/33182 ↗