OSVDB ID: 25232 Title: Linux Kernel SELinux Module Tracer SID Local DoS |
Info |
|
|
Dates |
||||
|
|
Description |
The Linux Kernel contains a flaw that may allow a local denial of service. The issue is triggered when 'selinux_ptrace' is used to trace a process. The SID that is set while doing so might be replaced later on accessing certain '/proc' files relating to that process, potentially allowing the owner of the original process to enter the other process' domain. This can result in unauthorised access to the target domain, but appears to be more likely to result in a kernel panic and hence in a loss of availability for the platform. |
Classification |
Location:
Local Access Required
Attack Type: Denial of Service Impact: Loss of Availability Exploit: Exploit Rumored Disclosure: OSVDB Verified, Vendor Verified |
Solution |
Upgrade to version 2.6.16-rc6 or higher, as it has been reported to fix this vulnerability. For Ubuntu users, the problem can be corrected by upgrading the affected package to version 2.6.10-34.17 (for Ubuntu 5.04) or 2.6.12-10.32 (for Ubuntu 5.10). An upgrade is required as there are no known workarounds. |
Products |
|
References |
|
Credit |
|
tycho.nsa.gov -