Date: Wed, 17 Aug 2005 08:59:55 +0200
From: Martin Pitt <martin.pitt@ubuntu.com>
To: Vendor Security <vendor-sec@lst.de>
Subject: [vendor-sec] Fwd: Re: CAN Request for kernel memory leak
Parts/Attachments:
   1 Shown    ~44 lines  Text
   2          196 bytes  Application, "Digital signature"
----------------------------------------

Hi everybody!

This was recently posted here, and I requested a CAN number for it.

FYI

Martin

----- Forwarded message from "Steven M. Christey" <coley@linus.mitre.org> -----

Date: Wed, 17 Aug 2005 02:06:30 -0400 (EDT)
From: "Steven M. Christey" <coley@linus.mitre.org>
To: Martin Pitt <martin.pitt@ubuntu.com>
Cc: cve@mitre.org
Subject: Re: CAN Request for kernel memory leak
X-Spam-Status: No, score=1.1 required=4.0 tests=AWL,BAYES_60 autolearn=no 
       version=3.0.3


======================================================
Candidate: CAN-2005-2617
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2617
Reference:
CONFIRM:http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=c
ommit;h=9fb1759a3102c26cd8f64254a7c3e532782c2bb8
Reference:
CONFIRM:http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=c
ommitdiff;h=9fb1759a3102c26cd8f64254a7c3e532782c2bb8

The syscall32_setup_pages function in syscall32.c for Linux kernel
2.6.x, on the 64-bit x86 platform, does not check the return value of
the insert_vm_struct function, which allows local users to trigger a
memory leak via a 32-bit application with crafted ELF headers.