Linux Kernel 'do_splice_from()'本地安全绕过漏洞

BUGTRAQ ID: 31903
CVE ID：CVE-2008-4554
CNCVE ID：CNCVE-20084554

Linux是一款开放源代码的操作系统。
Linux在执行部分文件操作时’do_splice_from()'函数不正确拒绝文件描述符，本地攻击者可以利用漏洞绕过本地安全限制。
攻击者可以绕过append-only限制，破坏系统文件。

RedHat Fedora 9 0
RedHat Fedora 8 0
Linux kernel 2.6.26 4
Linux kernel 2.6.26 3
Linux kernel 2.6.26 .6
Linux kernel 2.6.26 -rc6
Linux kernel 2.6.25 .9
Linux kernel 2.6.25 .8
Linux kernel 2.6.25 .7
Linux kernel 2.6.25 .6
Linux kernel 2.6.25 .5
Linux kernel 2.6.25 .15
Linux kernel 2.6.25 .13
Linux kernel 2.6.25 .12
Linux kernel 2.6.25 .11
Linux kernel 2.6.25 .10
Linux kernel 2.6.25
Linux kernel 2.6.24 .2
Linux kernel 2.6.24 .1
Linux kernel 2.6.24 -rc5
Linux kernel 2.6.24 -rc4
Linux kernel 2.6.24 -rc3
Linux kernel 2.6.23 .7
Linux kernel 2.6.23 .6
Linux kernel 2.6.23 .5
Linux kernel 2.6.23 .4
Linux kernel 2.6.23 .3
Linux kernel 2.6.23 .2
Linux kernel 2.6.23 -rc2
Linux kernel 2.6.23 -rc1
Linux kernel 2.6.23
Linux kernel 2.6.22 7
Linux kernel 2.6.22 1
Linux kernel 2.6.22 .8
Linux kernel 2.6.22 .6
Linux kernel 2.6.22 .5
Linux kernel 2.6.22 .4
Linux kernel 2.6.22 .3
Linux kernel 2.6.22 .17
Linux kernel 2.6.22 .16
Linux kernel 2.6.22 .15
Linux kernel 2.6.22 .14
Linux kernel 2.6.22 .13
Linux kernel 2.6.22 .12
Linux kernel 2.6.22 .11
Linux kernel 2.6.22
Linux kernel 2.6.21 4
Linux kernel 2.6.21 .7
Linux kernel 2.6.21 .6
Linux kernel 2.6.21 .2
Linux kernel 2.6.21 .1
Linux kernel 2.6.21
Linux kernel 2.6.20 .9
Linux kernel 2.6.20 .8
Linux kernel 2.6.20 .5
Linux kernel 2.6.20 .4
Linux kernel 2.6.20 .15
Linux kernel 2.6.20
Linux kernel 2.6.19 1
Linux kernel 2.6.19 .2
Linux kernel 2.6.19 .1
Linux kernel 2.6.19 -rc4
Linux kernel 2.6.19 -rc3
Linux kernel 2.6.19 -rc2

• Trustix Secure Enterprise Linux 2.0
• Trustix Secure Linux 2.2
• Trustix Secure Linux 2.1
• Trustix Secure Linux 2.0
  Linux kernel 2.6.19 -rc1
  Linux kernel 2.6.19
• Trustix Secure Enterprise Linux 2.0
• Trustix Secure Linux 2.2
• Trustix Secure Linux 2.1
• Trustix Secure Linux 2.0
  Linux kernel 2.6.18 .4
  Linux kernel 2.6.18 .3
  Linux kernel 2.6.18 .1
  Linux kernel 2.6.18
  Linux kernel 2.6.17 .8
  Linux kernel 2.6.17 .7
  Linux kernel 2.6.17 .6
  Linux kernel 2.6.17 .5
  Linux kernel 2.6.17 .3
  Linux kernel 2.6.17 .2
  Linux kernel 2.6.17 .14
  Linux kernel 2.6.17 .13
  Linux kernel 2.6.17 .12
  Linux kernel 2.6.17 .11
  Linux kernel 2.6.17 .10
  Linux kernel 2.6.17 .1
  Linux kernel 2.6.17 -rc5
  Linux kernel 2.6.17
• Trustix Secure Enterprise Linux 2.0
• Trustix Secure Linux 2.2
• Trustix Secure Linux 2.1
• Trustix Secure Linux 2.0
  Linux kernel 2.6.16 27
  Linux kernel 2.6.16 13
  Linux kernel 2.6.16 .9
  Linux kernel 2.6.16 .7
  Linux kernel 2.6.16 .23
  Linux kernel 2.6.16 .19
  Linux kernel 2.6.16 .12
  Linux kernel 2.6.16 .11
  Linux kernel 2.6.16 .1
  Linux kernel 2.6.16 -rc1
  Linux kernel 2.6.16
  Linux kernel 2.6.15 .4
  Linux kernel 2.6.15 .3
  Linux kernel 2.6.15 .2
  Linux kernel 2.6.15 .1
  Linux kernel 2.6.15 -rc3
  Linux kernel 2.6.15 -rc2
  Linux kernel 2.6.15 -rc1
  Linux kernel 2.6.15
• Trustix Secure Enterprise Linux 2.0
• Trustix Secure Linux 2.2
• Trustix Secure Linux 2.1
• Trustix Secure Linux 2.0
  Linux kernel 2.6.15
  Linux kernel 2.6.2
  Linux kernel 2.6.26.1
  Linux kernel 2.6.26-rc5-git1
  Linux kernel 2.6.25.4
  Linux kernel 2.6.25.3
  Linux kernel 2.6.25.2
  Linux kernel 2.6.25.1
  Linux kernel 2.6.24.6
  Linux kernel 2.6.24-rc2
  Linux kernel 2.6.24-rc1
  Linux kernel 2.6.23.14
  Linux kernel 2.6.23.10
  Linux kernel 2.6.23.1
  Linux kernel 2.6.23.09
  Linux kernel 2.6.22-rc7
  Linux kernel 2.6.22-rc1
  Linux kernel 2.6.21-RC6
  Linux kernel 2.6.21-RC5
  Linux kernel 2.6.21-RC4
  Linux kernel 2.6.21-RC3
  Linux kernel 2.6.21-RC3
  Linux kernel 2.6.20.3
  Linux kernel 2.6.20.2
  Linux kernel 2.6.20.13
  Linux kernel 2.6.20.11
  Linux kernel 2.6.20.1
  Linux kernel 2.6.20-rc2
  Linux kernel 2.6.20-2
  Linux kernel 2.6.18-8.1.8.el5
  Linux kernel 2.6.18-53
  Linux kernel 2.6.18
  Linux kernel 2.6.15.5
  Linux kernel 2.6.15.11
  Linux kernel 2.6.15-27.48
  可参考如下安全公告获得补丁信息：
  <a href=“https://bugzilla.redhat.com/show_bug.cgi?id=466707” target=“_blank”>https://bugzilla.redhat.com/show_bug.cgi?id=466707</a>