Bug 849734 (CVE-2012-3511)

Summary: CVE-2012-3511 kernel: mm: use-after-free in madvise_remove()
Product: [Other] Security Response Reporter: Petr Matousek <pmatouse>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: agordeev, anton, bhu, davej, davidyangyi, dhoward, fhrbata, gansalmon, iboverma, itamar, jforbes, jkacur, jlieskov, jneedle, jonathan, jrusnack, jwboyer, kernel-maint, kernel-mgr, lgoncalv, lwang, madhu.chinakonda, mcressma, nchavan, plougher, rt-maint, sforsber, williams, ybabar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-08-24 13:35:43 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 849735, 849736, 849738, 849739, 849740, 849741, 849742    
Bug Blocks: 849743    

Description Petr Matousek 2012-08-20 18:03:53 UTC
A use-after-free flaw has been found in madvise_remove() function in the Linux kernel. madvise_remove() can race with munmap (causing a use-after-free
of the vma) or with close (causing a use-after-free of the struct file). An unprivileged local user can use this flaw to crash the system and potentially gain higher privileges.

Upstream fix:

Introduced in:

Comment 3 Petr Matousek 2012-08-20 18:07:48 UTC
Created kernel tracking bugs for this issue

Affects: fedora-all [bug 849742]

Comment 5 davidyangyi 2012-08-30 05:42:00 UTC
Is there any fix released out now ?

Comment 6 Jan Lieskovsky 2012-08-30 10:25:58 UTC
(In reply to comment #5)
> Is there any fix released out now ?

Not yet (as of right now). Please refer to Red Hat CVE database entry:
[1] https://access.redhat.com/security/cve/CVE-2012-3511

for progress / updates.

Thank you && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Response Team

Comment 11 errata-xmlrpc 2012-11-06 18:19:07 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:1426 https://rhn.redhat.com/errata/RHSA-2012-1426.html

Comment 12 errata-xmlrpc 2012-12-04 19:58:47 UTC
This issue has been addressed in following products:

  MRG for RHEL-6 v.2

Via RHSA-2012:1491 https://rhn.redhat.com/errata/RHSA-2012-1491.html

Comment 14 Vincent Danen 2013-09-26 15:35:01 UTC


Comment 15 errata-xmlrpc 2013-09-26 17:21:17 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2013:1292 https://rhn.redhat.com/errata/RHSA-2013-1292.html