CVE-2008-2365

CVE Details

Release Date:	2008-06-30
Impact:	Important	What is this?

Description

Race condition in the ptrace and utrace support in the Linux kernel 2.6.9 through 2.6.25, as used in Red Hat Enterprise Linux (RHEL) 4, allows local users to cause a denial of service (oops) via a long series of PTRACE_ATTACH ptrace calls to another user's process that trigger a conflict between utrace_detach and report_quiescent, related to late ptrace_may_attach() check and race around dead_engine_ops setting, a different vulnerability than CVE-2007-0771 and CVE-2008-1514. NOTE: this issue might only affect kernel versions before 2.6.16.x.

See more information about CVE-2008-2365 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v2 metrics

Base Score:	4.7
Vector String:	AV:L/AC:M/Au:N/C:N/I:N/A:C
Version:	2.0
Attack Vector:	Local
Attack Complexity:	Medium
Authentication:	None
Confidentiality Impact:	None
Integrity Impact:	None
Availability Impact:	Complete

Errata information

Platform	Errata	Release Date
Oracle Enterprise Linux version 4 (kernel)	ELSA-2008-0508	2008-06-26
Oracle Enterprise Linux version 4 (ocfs2-2.6.9-67.0.20.0.1.EL)	ELSA-2008-0508	2008-06-26
Oracle Enterprise Linux version 4 (oracleasm-2.6.9-67.0.20.0.1.EL)	ELSA-2008-0508	2008-06-26