Bug 651670 - kernel: perf bug
Summary: kernel: perf bug
Keywords:
Status: CLOSED DUPLICATE of bug 651671
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-11-10 03:58 UTC by Eugene Teo (Security Response)
Modified: 2019-09-29 12:40 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-11-10 07:46:05 UTC
Embargoed:

Attachments (Terms of Use)

Description Eugene Teo (Security Response) 2010-11-10 03:58:23 UTC 
Description of problem:
Upstream commit dab5855 ("perf_counter: Add mmap event hooks to mprotect()") is fundamentally wrong as mprotect_fixup() can free 'vma' due to merging. Fix the problem by moving perf_event_mmap() hook to mprotect_fixup(). In certain scenario, a local, unprivileged user could use this flaw to trigger a denial of service.

Upstream commit:
http://git.kernel.org/linus/63bfd7384b119409685a17d5c58f0b56e5dc03da
Comment 1 Eugene Teo (Security Response) 2010-11-10 07:46:05 UTC 

*** This bug has been marked as a duplicate of bug 651671 ***
Note You need to log in before you can comment on or make changes to this bug.