Description of problem: The TIOCGICOUNT device ioctl in serial_core.c allows unprivileged users to read uninitialized stack memory, because the "reserved" member of the serial_icounter_struct struct declared on the stack is not altered or zeroed before being copied back to the user. Reference: http://www.openwall.com/lists/oss-security/2010/10/06/6 http://lkml.indiana.edu/hypermail//linux/kernel/1009.1/03388.html Acknowledgements: Red Hat would like to thank Dan Rosenberg for reporting this issue.
Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 3 as it did not include the affected functionality.
Upstream commit: http://git.kernel.org/linus/d281da7ff6f70efca0553c288bb883e8605b3862
This issue has been addressed in following products: MRG for RHEL-5 Via RHSA-2010:0958 https://rhn.redhat.com/errata/RHSA-2010-0958.html
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2011:0007 https://rhn.redhat.com/errata/RHSA-2011-0007.html
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2011:0017 https://rhn.redhat.com/errata/RHSA-2011-0017.html
This issue has been addressed in following products: Red Hat Enterprise Linux 4 Via RHSA-2011:0162 https://rhn.redhat.com/errata/RHSA-2011-0162.html