SB2017102908 - Data Handling in Linux kernel
Published: October 29, 2017 Updated: July 18, 2020
Security Bulletin ID
SB2017102908
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Data Handling (CVE-ID: CVE-2006-5331)
The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.
The altivec_unavailable_exception function in arch/powerpc/kernel/traps.c in the Linux kernel before 2.6.19 on 64-bit systems mishandles the case where CONFIG_ALTIVEC is defined and the CPU actually supports Altivec, but the Altivec support was not detected by the kernel, which allows local users to cause a denial of service (panic) by triggering execution of an Altivec instruction.
Remediation
Install update from vendor's website.
References
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6c4841c2b6c32a134f9f36e5e08857138cc12b10
- http://www.linuxgrill.com/anonymous/kernel/v2.6/ChangeLog-2.6.19
- https://bugzilla.suse.com/show_bug.cgi?id=213229
- https://github.com/torvalds/linux/commit/6c4841c2b6c32a134f9f36e5e08857138cc12b10