Info

Disclosure

May 11, 2006

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

The Linux kernel contains a flaw that may allow a local denial of service. The issue is triggered due to a error within the "lease_init()" function in "fs/locks.c" which may free memory that was not allocated using the "locks_alloc_lock()" function, and will result in loss of availability for the platform.

Classification

Location: Local Access Required
Attack Type: Denial of Service
Impact: Loss of Availability
Exploit: Exploit Rumored
Disclosure: OSVDB Verified, Vendor Verified

Solution

Upgrade to version 2.6.16.16 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Linux	Kernel	2.6.15.*
		2.6.14.*
		2.6.13.*
		2.6.12.*
		2.6.11.*
		2.6.10.*
		2.6.9.*
		2.6.8.*
		2.6.7.*
		2.6.6.*
		2.6.5.*
		2.6.4.*
		2.6.3.*
		2.6.2.*
		2.6.1.*
		2.6.16.16
		2.6.16.15

References

Bugtraq ID: 17943
CVE ID: 2006-1860 (see also: NVD)
Secunia Advisory ID: 20083 20716 21045 21179
VUPEN Advisory: ADV-2006-1767
Vendor Specific Advisory URL: http://lists.suse.com/archive/suse-security-announce/2006-Jul/0008.html
http://www.ubuntu.com/usn/usn-302-1
Vendor Specific News/Changelog Entry: http://www.kernel.org/git/?p=linux/kernel/git/stable/linux-2.6.16.y.git;a=commit;h=1f0e637c94a9b041833947c79110d6c02fff8618
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.16
Other Advisory URL: http://www.mandriva.com/security/advisories?name=MDKSA-2006:123

Credit

Daniel Hokka Zakrisson - danielhozac.com -

Direct URL: http://osvdb.org/25425