PT-2006-1008 · Debian+2 · Debian+2
Hugh Dickins
·
Published
2006-12-31
·
Updated
2017-09-29
·
CVE-2007-4133
CVSS v2.0
7.2
High
| Vector | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Debian GNU/Linux kernel-patch-openvz (affected versions not specified)
Linux kernel versions prior to 2.6.19-rc4
Description:
The issue concerns multiple vulnerabilities in the kernel-patch-openvz package of Debian GNU/Linux and the Linux kernel, which can be exploited by a local attacker to compromise the confidentiality, integrity, and availability of protected information. The Linux kernel vulnerabilities are related to the
hugetlb vmtruncate list and hugetlb vmtruncate functions in fs/hugetlbfs/inode.c, where certain calculations are performed using HPAGE SIZE instead of PAGE SIZE units, allowing local users to cause a denial of service via unspecified vectors.Recommendations:
For Debian GNU/Linux kernel-patch-openvz, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
For Linux kernel versions prior to 2.6.19-rc4, update to version 2.6.19-rc4 or later to resolve the issue. As a temporary workaround, consider restricting access to the
hugetlb vmtruncate list and hugetlb vmtruncate functions to minimize the risk of exploitation. Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Debian
Linux Kernel
Red Hat