Ubuntu
linux package

  1. Karmic (9.10)
  2. Bug #413656
  3. Comment #15

Comment 15 for bug 413656

Revision history for this message
In , Eugene (eugene-redhat-bugs) wrote :

Description of problem:
Reported by Tavis Ormandy and Julien Tinnes. The SOCKOPS_WRAP macro from include/linux/net.h doesn't initialise the sendpage operation in the proto_ops structure correctly. Leading to a kernel NULL pointer dereference, and thus a local privilege escalation.

Acknowledgements:

Red Hat would like to thank Tavis Ormandy and Julien Tinnes of the Google
Security Team for responsibly reporting this flaw.