PT-2019-6624 · Linux · Pax-Linux

Francisco Blas Izquierdo Riera + 1 · Publicado 2019-12-26 · Atualizado 2020-01-10 · CVE-2011-1474

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions pax-linux versions 2.6.32.33-test79.patch, 2.6.37.4-test14.patch, 2.6.38-test3.patch

Description A locally exploitable DOS issue was found in pax-linux. It is caused by a bad bounds check in arch get unmapped area topdown triggered by programs doing an mmap after a MAP GROWSDOWN mmap, creating an infinite loop condition without releasing the VM semaphore, eventually leading to a system crash.

Recommendations For version 2.6.32.33-test79.patch, consider disabling the arch get unmapped area topdown function to prevent the infinite loop condition. For version 2.6.37.4-test14.patch, restrict the use of mmap with MAP GROWSDOWN to minimize the risk of exploitation. For version 2.6.38-test3.patch, avoid using mmap after MAP GROWSDOWN mmap until the issue is resolved.

Correção

Infinite Loop

Resource Exhaustion

Enumeração de Fraquezas

CWE-835

CWE-400

Identificadores relacionados

CVE-2011-1474

Produtos afetados

Pax-Linux

Referências · 4

• http://seclists.org/oss-sec/2011/q1/579 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-1474 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2011-1474 · Aviso do Fabricante
• https://t.me/cibsecurity/8859 · Publicação no Telegram