CVE-2012-3375

Severity

49%

Complexity

39%

Confidentiality

115%

The epoll_ctl system call in fs/eventpoll.c in the Linux kernel before 3.2.24 does not properly handle ELOOP errors in EPOLL_CTL_ADD operations, which allows local users to cause a denial of service (file-descriptor consumption and system crash) via a crafted application that attempts to create a circular epoll dependency. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1083.

The epoll_ctl system call in fs/eventpoll.c in the Linux kernel before 3.2.24 does not properly handle ELOOP errors in EPOLL_CTL_ADD operations, which allows local users to cause a denial of service (file-descriptor consumption and system crash) via a crafted application that attempts to create a circular epoll dependency. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1083.

CVSS 2.0 Base Score 4.9. CVSS Attack Vector: local. CVSS Attack Complexity: low. CVSS Vector: (AV:L/AC:L/Au:N/C:N/I:N/A:C).

Overview

First reported 12 years ago

2012-10-03 11:02:00

Last updated 11 years ago

2013-08-17 06:46:00

Affected Software

Linux Kernel 3.0.1

3.0.1

Linux Kernel 3.0.2

3.0.2

Linux Kernel 3.0.3

3.0.3

Linux Kernel 3.0.4

3.0.4

Linux Kernel 3.0.5

3.0.5

Linux Kernel 3.0.6

3.0.6

Linux Kernel 3.0.7

3.0.7

Linux Kernel 3.0.8

3.0.8

Linux Kernel 3.0.9

3.0.9

Linux Kernel 3.0.10

3.0.10

Linux Kernel 3.0.11

3.0.11

Linux Kernel 3.0.12

3.0.12

Linux Kernel 3.0.13

3.0.13

Linux Kernel 3.0.14

3.0.14

Linux Kernel 3.0.15

3.0.15

Linux Kernel 3.0.16

3.0.16

Linux Kernel 3.0.17

3.0.17

Linux Kernel 3.0.18

3.0.18

Linux Kernel 3.0.19

3.0.19

Linux Kernel 3.0.20

3.0.20

Linux Kernel 3.0.21

3.0.21

Linux Kernel 3.0.22

3.0.22

Linux Kernel 3.0.23

3.0.23

Linux Kernel 3.0.24

3.0.24

Linux Kernel 3.0.25

3.0.25

Linux Kernel 3.0.26

3.0.26

Linux Kernel 3.0.27

3.0.27

Linux Kernel 3.0.28

3.0.28

Linux Kernel 3.0.29

3.0.29

Linux Kernel 3.0.30

3.0.30

Linux Kernel 3.0.31

3.0.31

Linux Kernel 3.0.32

3.0.32

Linux Kernel 3.0.33

3.0.33

Linux Kernel 3.0.34

3.0.34

Linux Kernel 3.1.1

3.1.1

Linux Kernel 3.1.2

3.1.2

Linux Kernel 3.1.3

3.1.3

Linux Kernel 3.1.4

3.1.4

Linux Kernel 3.1.5

3.1.5

Linux Kernel 3.1.6

3.1.6

Linux Kernel 3.1.7

3.1.7

Linux Kernel 3.1.8

3.1.8

Linux Kernel 3.1.9

3.1.9

Linux Kernel 3.1.10

3.1.10

Linux Kernel 3.2.1

3.2.1

Linux Kernel 3.2.2

3.2.2

Linux Kernel 3.2.3

3.2.3

Linux Kernel 3.2.4

3.2.4

Linux Kernel 3.2.5

3.2.5

Linux Kernel 3.2.6

3.2.6

Linux Kernel 3.2.7

3.2.7

Linux Kernel 3.2.8

3.2.8

Linux Kernel 3.2.9

3.2.9

Linux Kernel 3.2.10

3.2.10

Linux Kernel 3.2.11

3.2.11

Linux Kernel 3.2.12

3.2.12

Linux Kernel 3.2.13

3.2.13

Linux Kernel 3.2.14

3.2.14

Linux Kernel 3.2.15

3.2.15

Linux Kernel 3.2.16

3.2.16

Linux Kernel 3.2.17

3.2.17

Linux Kernel 3.2.18

3.2.18

Linux Kernel 3.2.19

3.2.19

Linux Kernel 3.2.20

3.2.20

Linux Kernel 3.2.21

3.2.21

Linux Kernel 3.2.22

3.2.22

Linux Kernel

References

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=13d518074a952d33d47c428419693f63389547e9

51164

USN-1529-1

http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.24

[oss-security] 20120704 Re: CVE Request -- kernel: epoll: can leak file descriptors when returning -ELOOP

1027237

https://bugzilla.redhat.com/show_bug.cgi?id=837502

https://downloads.avaya.com/css/P8/documents/100165733

https://github.com/torvalds/linux/commit/13d518074a952d33d47c428419693f63389547e9

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.