PT-2006-1008 · Debian+2 · Debian+2
Hugh Dickins
·
Publicado
2006-12-31
·
Atualizado
2017-09-29
·
CVE-2007-4133
CVSS v2.0
7.2
Alta
| Vetor | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Debian GNU/Linux kernel-patch-openvz (affected versions not specified)
Linux kernel versions prior to 2.6.19-rc4
Description:
The issue concerns multiple vulnerabilities in the kernel-patch-openvz package of Debian GNU/Linux and the Linux kernel, which can be exploited by a local attacker to compromise the confidentiality, integrity, and availability of protected information. The Linux kernel vulnerabilities are related to the
hugetlb vmtruncate list and hugetlb vmtruncate functions in fs/hugetlbfs/inode.c, where certain calculations are performed using HPAGE SIZE instead of PAGE SIZE units, allowing local users to cause a denial of service via unspecified vectors.Recommendations:
For Debian GNU/Linux kernel-patch-openvz, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
For Linux kernel versions prior to 2.6.19-rc4, update to version 2.6.19-rc4 or later to resolve the issue. As a temporary workaround, consider restricting access to the
hugetlb vmtruncate list and hugetlb vmtruncate functions to minimize the risk of exploitation. Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Debian
Linux Kernel
Red Hat