Improper locking in Linux kernel

1) Improper locking

EUVDB-ID: #VU95584

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2006-1860

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform service disruption.

lease_init in fs/locks.c in Linux kernel before 2.6.16.16 allows attackers to cause a denial of service (fcntl_setlease lockup) via actions that cause lease_init to free a lock that might not have been allocated on the stack.

Mitigation

Install update from vendor's repository.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

https://secunia.com/advisories/20083
https://secunia.com/advisories/20716
https://secunia.com/advisories/21045
https://secunia.com/advisories/21179
https://www.kernel.org/git/?p=linux/kernel/git/stable/linux-2.6.16.y.git;a=blobdiff;h=aa7f66091823dde953e15895dc427615701c39c7;hp=e75ac392a313f3fad823bf2e46a03f29701e3e34;hb=1f0e637c94a9b041833947c79110d6c02fff8618;f=fs/locks.c
https://www.kernel.org/git/?p=linux/kernel/git/stable/linux-2.6.16.y.git;a=commit;h=1f0e637c94a9b041833947c79110d6c02fff8618
https://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.16
https://www.mandriva.com/security/advisories?name=MDKSA-2006:123
https://www.novell.com/linux/security/advisories/2006_42_kernel.html
https://www.osvdb.org/25425
https://www.securityfocus.com/bid/17943
https://www.trustix.org/errata/2006/0028
https://www.ubuntu.com/usn/usn-302-1
https://www.vupen.com/english/advisories/2006/1767
https://exchange.xforce.ibmcloud.com/vulnerabilities/26437

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.