Missing release of memory after effective lifetime in Linux kernel - CVE-2002-1571

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU99980

Missing release of memory after effective lifetime in Linux kernel - CVE-2002-1571

Published: December 31, 2002 / Updated: September 5, 2008


Vulnerability identifier: #VU99980
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2002-1571
CWE-ID: CWE-401
Exploitation vector: Local access
Exploit availability: No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel

Detailed vulnerability description

The vulnerability allows a local user to gain access to sensitive information.

The linux 2.4 kernel before 2.4.19 assumes that the fninit instruction clears all registers, which could lead to an information leak on processors that do not clear all relevant SSE registers.


How to mitigate CVE-2002-1571

Install update from vendor's repository.

Sources