[kernel-sec-discuss] r1402 - active

[Moritz Muehlenhoff]

Author: jmm
Date: 2009-06-06 21:41:48 +0000 (Sat, 06 Jun 2009)
New Revision: 1402

Added:
   active/CVE-2009-1961
Log:
new issue


Added: active/CVE-2009-1961
===================================================================
--- active/CVE-2009-1961	                        (rev 0)
+++ active/CVE-2009-1961	2009-06-06 21:41:48 UTC (rev 1402)
@@ -0,0 +1,29 @@
+Candidate: CVE-2009-1961
+Description:
+ The inode double locking code in fs/ocfs2/file.c in the Linux kernel
+ 2.6.30 before 2.6.30-rc3, 2.6.27 before 2.6.27.24, 2.6.29 before 2.6.29.4,
+ and possibly other versions down to 2.6.19 allows local users to cause a
+ denial of service (prevention of file creation and removal) via a series
+ of splice system calls that trigger a deadlock between the
+ generic_file_splice_write, splice_from_pipe, and ocfs2_file_splice_write
+ functions.
+References:
+ http://www.openwall.com/lists/oss-security/2009/05/29/2
+ http://www.openwall.com/lists/oss-security/2009/05/30/1
+ http://www.openwall.com/lists/oss-security/2009/06/02/2
+ http://www.openwall.com/lists/oss-security/2009/06/03/1
+ http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=7bfac9ecf0585962fe13584f5cf526d8c8e76f17
+Ubuntu-Description:
+Notes:
+Bugs:
+upstream:
+linux-2.6:
+2.6.18-etch-security:
+2.6.24-etch-security:
+2.6.26-lenny-security:
+2.6.15-dapper-security:
+2.6.22-gutsy-security:
+2.6.24-hardy-security:
+2.6.27-intrepid-security:
+
+