kernel: fix soft lockups/OOM issues with unix socket garbage collector

Linux kernel 2.6.28 allows local users to cause a denial of service "soft lockup" and process loss via a large number of sendmsg function calls, which does not block during AFUNIX garbage collection and triggers an OOM condition, a different vulnerability than CVE-2008-5029...

linux-panic.txt

include include include include include include static int ownchildint us int pid; int s2; struct msghdr mh; char crap1024; struct iovec iov; struct cmsghdr c; int fd; int rc; pid = fork; if pid == -1 err1, "fork"; if pid closeus1; return pid; closeus0; memset&mh, 0, sizeofmh; iov.iovbase = "a";...

CVE-2008-5029

The scmdestroy function in net/core/scm.c in the Linux kernel 2.6.27.4, 2.6.26, and earlier makes indirect recursive calls to itself through calls to the fput function, which allows local users to cause a denial of service panic via vectors related to sending an SCMRIGHTS message through a UNIX...

Design/Logic Flaw

The scmdestroy function in net/core/scm.c in the Linux kernel 2.6.27.4, 2.6.26, and earlier makes indirect recursive calls to itself through calls to the fput function, which allows local users to cause a denial of service panic via vectors related to sending an SCMRIGHTS message through a UNIX...

CVE-2008-5029

CVE-2008-5029 affects the Linux kernel 2.6.27.4, 2.6.26 and earlier via the __scm_destroy function in net/core/scm.c, which can cause indirect recursive calls when closing sockets after an SCM_RIGHTS message. This local DoS (panic) condition results from the kernel’s handling of UNIX domain socke...

CVE-2008-5029

The scmdestroy function in net/core/scm.c in the Linux kernel 2.6.27.4, 2.6.26, and earlier makes indirect recursive calls to itself through calls to the fput function, which allows local users to cause a denial of service panic via vectors related to sending an SCMRIGHTS message through a UNIX...

Important: Red Hat Security Advisory: kernel security and bug fix update

Updated kernel packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux...

Important: Red Hat Security Advisory: kernel security and bug fix update

Updated kernel packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux...

Important: cups security and bug fix update

1.2.4-11.14.el51.1 - Applied patch to fix CVE-2007-4351 STR 2561, bug 353981. 1.2.4-11.14 - Applied patch to fix cupsd crash when failing to open a file: URI STR 2351, bug 250415. 1.2.4-11.13 - Moved LSPP security attributes check before job creation bug 231522. 1.2.4-11.12 - Moved LSPP access...

Mandrake Linux Security Advisory : gdm (MDKSA-2007:169)

A vulnerability was discovered in how gdm listens on its unix domain socket. A local user could crash a running X session by writing malicious data to gdm's unix domain socket. Updated packages have been patched to prevent this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

RHEL 5 : gdm (RHSA-2007:0777)

An updated gdm package that fixes a security issue is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Gdm the GNOME Display Manager is a highly configurable reimplementation of xdm, the X Display...

CentOS 5 : gdm (CESA-2007:0777)

An updated gdm package that fixes a security issue is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Gdm the GNOME Display Manager is a highly configurable reimplementation of xdm, the X Display...

gdm security update

CentOS Errata and Security Advisory CESA-2007:0777 An updated gdm package that fixes a security issue is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Gdm the GNOME Display Manager is a highly...

Moderate: Red Hat Security Advisory: gdm security and bug fix update

An updated gdm package that fixes a security issue is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Gdm the GNOME Display Manager is a highly configurable reimplementation of xdm, the X Display...

Mandrake Linux Security Advisory : hylafax (MDKSA-2005:177)

faxcron, recvstats, and xferfaxstats in HylaFax 4.2.1 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files. CVE-2005-3069 In addition, HylaFax has some provisional support for Unix domain sockets, which is disabled in the default compile configuratio...

CVE-2005-3070

HylaFax 4.2.1 and earlier does not create or verify ownership of the UNIX domain socket, which might allow local users to read faxes and cause a denial of service by creating the socket using the hyla.unix temporary file...

CVE-2005-3070

HylaFax 4.2.1 and earlier does not create or verify ownership of the UNIX domain socket, which might allow local users to read faxes and cause a denial of service by creating the socket using the hyla.unix temporary file...

CVE-2005-3070

HylaFax 4.2.1 and earlier does not create or verify ownership of the UNIX domain socket, which might allow local users to read faxes and cause a denial of service by creating the socket using the hyla.unix temporary file...

CVE-2005-3070

HylaFax 4.2.1 and earlier does not create or verify ownership of the UNIX domain socket, which might allow local users to read faxes and cause a denial of service by creating the socket using the hyla.unix temporary file...

CVE-2004-1069

Race condition in SELinux 2.6.x through 2.6.9 allows local users to cause a denial of service kernel crash via SOCKSEQPACKET unix domain sockets, which are not properly handled in the sockdgramsendmsg function...