[Xen-bugs] [Bug 738] New: Critical Kernel vulnerability (bug allows a local user to gain root privileges)

[bugzilla-daemon@xxxxxxxxxxxxxxxxxxx]

http://bugzilla.xensource.com/bugzilla/show_bug.cgi?id=738

           Summary: Critical Kernel vulnerability (bug allows a local user
                    to gain root privileges)
           Product: Xen
           Version: 3.0 (general)
          Platform: Other
        OS/Version: Linux
            Status: NEW
          Severity: major
          Priority: P2
         Component: Unspecified
        AssignedTo: xen-bugs@xxxxxxxxxxxxxxxxxxx
        ReportedBy: rogermm@xxxxxxxxx


The bug allows a local user to gain root privileges via the PR_SET_DUMPABLE
argument of the prctl function and a program that causes a core dump file to be
created in a directory for which the user does not have permissions.

It only exists in the Linux kernel 2.6.13 up to versions before 2.6.17.4, and
2.6.16 before 2.6.16.24 ( XEN 3.0-testing use 2.6.16.13 ).

References:

http://www.debian.org/News/2006/20060713
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2451


-- 
Configure bugmail: 
http://bugzilla.xensource.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

_______________________________________________
Xen-bugs mailing list
Xen-bugs@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-bugs