Race condition in Linux kernel

1) Race condition

EUVDB-ID: #VU95469

Risk: Low

CVSSv3.1: 4.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2005-3527

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

Race condition in do_coredump in signal.c in Linux kernel 2.6 allows local users to cause a denial of service by triggering a core dump in 1 thread while another thread has a pending SIGSTOP.

Mitigation

Install update from vendor's repository.

Vulnerable software versions

Linux kernel: All versions

External links

http://secunia.com/advisories/17917
http://secunia.com/advisories/17918
http://www.kernel.org/git/?p=linux/kernel/git/davem/sparc-2.6.git;a=commitdiff;h=788e05a67c343fa22f2ae1d3ca264e7f15c25eaf
http://www.mandriva.com/security/advisories?name=MDKSA-2006:018
http://www.securityfocus.com/advisories/9806
http://www.securityfocus.com/archive/1/419522/100/0/threaded
http://www.securityfocus.com/archive/1/427981/100/0/threaded
http://www.securityfocus.com/bid/15723

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.