#VU95734 Resource management errors in Linux kernel - CVE-2008-5300
Vulnerability identifier: #VU95734
Vulnerability risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID:
CWE-ID:
CWE-399
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
Linux kernel
Operating systems & Components /
Operating system
Vendor: Linux Foundation
Description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
Linux kernel 2.6.28 allows local users to cause a denial of service ('soft lockup' and process loss) via a large number of sendmsg function calls, which does not block during AF_UNIX garbage collection and triggers an OOM condition, a different vulnerability than CVE-2008-5029.
Mitigation
Install update from vendor's repository.
Vulnerable software versions
Linux kernel: All versions
External links
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=473259
https://marc.info/?l=linux-netdev&m=122721862313564&w=2
https://marc.info/?l=linux-netdev&m=122765505415944&w=2
https://osvdb.org/50272
https://secunia.com/advisories/32913
https://secunia.com/advisories/32998
https://secunia.com/advisories/33083
https://secunia.com/advisories/33348
https://secunia.com/advisories/33556
https://secunia.com/advisories/33706
https://secunia.com/advisories/33756
https://secunia.com/advisories/33854
https://securityreason.com/securityalert/4673
https://wiki.rpath.com/wiki/Advisories:rPSA-2008-0332
https://www.debian.org/security/2008/dsa-1681
https://www.mandriva.com/security/advisories?name=MDVSA-2009:032
https://www.redhat.com/support/errata/RHSA-2009-0014.html
https://www.redhat.com/support/errata/RHSA-2009-0053.html
https://www.securityfocus.com/archive/1/499044/100/0/threaded
https://www.securityfocus.com/archive/1/512019/100/0/threaded
https://www.securityfocus.com/bid/32516
https://www.ubuntu.com/usn/usn-715-1
https://bugzilla.redhat.com/show_bug.cgi?id=470201
https://exchange.xforce.ibmcloud.com/vulnerabilities/46943
https://issues.rpath.com/browse/RPL-2915
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10283
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11427
https://rhn.redhat.com/errata/RHSA-2009-1550.html
https://usn.ubuntu.com/714-1/
https://www.redhat.com/archives/fedora-package-announce/2008-December/msg01358.html
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
