Design/Logic Flaw

2009-11-0215:30:00

PRIOn knowledge base

www.prio-n.com

6.5 Medium

AI Score

Confidence

Low

4.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

5.4%

JSON

The get_instantiation_keyring function in security/keys/keyctl.c in the KEYS subsystem in the Linux kernel before 2.6.32-rc5 does not properly maintain the reference count of a keyring, which allows local users to gain privileges or cause a denial of service (OOPS) via vectors involving calls to this function without specifying a keyring by ID, as demonstrated by a series of keyctl request2 and keyctl list commands.

CPENameOperatorVersion
kerneleq2.6.24.7
kerneleq2.6.25.15
linux_kerneleq2.6.27.29
linux_kerneleq2.6.27.12
linux_kerneleq2.6.20.6
linux_kerneleq2.6.28 rc4
linux_kerneleq2.6.25.4 x86-64
linux_kerneleq2.6.25.11 x86-64
linux_kerneleq2.6.28 git7
linux_kerneleq2.6.20.9

Name	Operator	Version
kernel	eq	2.6.24.7
kernel	eq	2.6.25.15
linux_kernel	eq	2.6.27.29
linux_kernel	eq	2.6.27.12
linux_kernel	eq	2.6.20.6
linux_kernel	eq	2.6.28 rc4
linux_kernel	eq	2.6.25.4 x86-64
linux_kernel	eq	2.6.25.11 x86-64
linux_kernel	eq	2.6.28 git7
linux_kernel	eq	2.6.20.9