SB2002123106 - Missing release of memory after effective lifetime in Linux kernel
Published: December 31, 2002
Security Bulletin ID
SB2002123106
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Missing release of memory after effective lifetime (CVE-ID: CVE-2002-1571)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to gain access to sensitive information.
The linux 2.4 kernel before 2.4.19 assumes that the fninit instruction clears all registers, which could lead to an information leak on processors that do not clear all relevant SSE registers.
Remediation
Install update from vendor's website.
References
- http://linux.bkbits.net:8080/linux-2.4/diffs/arch/i386/kernel/i387.c@1.6
- http://search.luky.org/linux-kernel.2002/msg24003.html
- http://search.luky.org/linux-kernel.2002/msg24992.html
- http://www.cs.helsinki.fi/linux/linux-kernel/2002-15/0628.html
- http://www.cs.helsinki.fi/linux/linux-kernel/2002-15/0760.html