Linux Kernel 'AGPIOC_RESERVE'和'AGPIOC_ALLOCATE' IOCTL'本地拒绝服务漏洞

Bugtraq ID: 47832 CVE ID：CVE-2011-1747 Linux是一款开放源代码的操作系统。 pagecount拷贝自用户空间，agpallocatememory有尝试检查此数是否过大，但是没有考虑其wrap的情况。agpcreateusermemory也没有检查通过numagppages变量计算的allocsize是否溢出。这可导致分配过小的缓冲区之后触发缓冲区溢出。 AGP代码中的另一个问题没有在补丁中解决 - 内核内存耗竭AGPIOCRESERVE和AGPIOCALLOCATE...

CVE-2011-1747

The agp subsystem in the Linux kernel 2.6.38.5 and earlier does not properly restrict memory allocation by the 1 AGPIOCRESERVE and 2 AGPIOCALLOCATE ioctls, which allows local users to cause a denial of service memory consumption by making many calls to these ioctls...