PT-2012-1030 · Linux+4 · Linux Kernel+4

Petr Matousek · Published 2012-04-17 · Updated 2023-02-13 · CVE-2012-0879

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.33

Description The issue is related to the I/O implementation for block devices in the Linux kernel, which does not properly handle the CLONE IO feature. This can be exploited by local users to cause a denial of service, resulting in I/O instability, by starting multiple processes that share an I/O context. Additionally, there are multiple vulnerabilities in the Linux 2.6 package of the Debian GNU/Linux operating system that can lead to violations of confidentiality, integrity, and availability of protected information.

Recommendations For Linux kernel versions prior to 2.6.33, update to version 2.6.33 or later to resolve the issue. At the moment, there is no information about additional mitigation measures for this specific vulnerability.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2015-01796

CESA-2012_0481

CVE-2012-0879

DSA-2469-1

RHSA-2012:0481

RHSA-2012_0481

Affected Products

Centos

Debian

Linux Kernel

Red Hat

Suse

References · 28

• https://github.com/torvalds/linux/commit/61cc74fbb87af6aa551a06a370590c9bc07e29d9 · Patch
• https://github.com/torvalds/linux/commit/b69f2292063d2caf37ca9aec7d63ded203701bf3 · Patch
• http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00013.html · Vendor Advisory
• http://ubuntu.com/usn/USN-1410-1 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=139447903326211&w=2 · Vendor Advisory
• http://ubuntu.com/usn/USN-1411-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0879 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4086 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-0879 · Security Note
• http://rhn.redhat.com/errata/RHSA-2012-0531.html · Vendor Advisory
• http://debian.org/security/2012/dsa-2469 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2012-2007.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2123 · Security Note
• http://ubuntu.com/usn/USN-1408-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2133 · Security Note