The do_exit function in kernel/exit.c in the Linux kernel before 2.6.36.2 does not properly handle a KERNEL_DS get_fs value, which allows local users to bypass intended access_ok restrictions, overwrite arbitrary kernel memory locations, and gain privileges by leveraging a (1) BUG, (2) NULL pointer dereference, or (3) page fault, as demonstrated by vectors involving the clear_child_tid feature and the splice system call.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 3, 2010 |
| Suse | — | Upgrade kernel-xen-develUpgrade kernel-symsUpgrade kernel-ppc64Upgrade kernel-pae-develUpgrade kernel-sourceUpgrade kernel-trace-baseUpgrade kernel-xenUpgrade kernel-pae-baseUpgrade kernel-xen-baseUpgrade kernel-paeUpgrade kernel-traceUpgrade kernel-trace-develUpgrade kernel-default-develUpgrade kernel-default-baseUpgrade kernel-ppc64-baseUpgrade kernel-defaultUpgrade kernel-docsUpgrade kernel-default-manUpgrade kernel-ppc64-devel | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade linux-image-2.6.15-57-itaniumUpgrade linux-image-2.6.24-29-lpiaUpgrade linux-image-2.6.15-57-amd64-serverUpgrade linux-image-2.6.15-57-serverUpgrade linux-image-2.6.15-57-itanium-smpUpgrade linux-image-2.6.15-57-server-bigironUpgrade linux-image-2.6.24-29-openvzUpgrade linux-image-2.6.15-57-powerpcUpgrade linux-image-2.6.24-29-hppa32Upgrade linux-image-2.6.15-57-amd64-xeonUpgrade linux-image-2.6.32-312-ec2Upgrade linux-image-2.6.35-25-powerpc-smpUpgrade linux-image-2.6.24-29-rtUpgrade linux-image-2.6.15-57-k7Upgrade linux-image-2.6.31-609-imx51Upgrade linux-image-2.6.15-57-mckinleyUpgrade linux-image-2.6.35-25-omapUpgrade linux-image-2.6.15-57-powerpc-smpUpgrade linux-image-2.6.32-28-powerpc64-smpUpgrade linux-image-2.6.15-57-sparc64-smpUpgrade linux-image-2.6.35-25-versatileUpgrade linux-image-2.6.35-25-powerpc64-smpUpgrade linux-image-2.6.15-57-hppa64-smpUpgrade linux-image-2.6.24-29-sparc64Upgrade linux-image-2.6.24-29-itaniumUpgrade linux-image-2.6.35-25-serverUpgrade linux-image-2.6.35-25-virtualUpgrade linux-image-2.6.32-28-powerpc-smpUpgrade linux-image-2.6.24-29-386Upgrade linux-image-2.6.32-28-versatileUpgrade linux-image-2.6.32-28-ia64Upgrade linux-image-2.6.15-57-386Upgrade linux-image-2.6.15-57-amd64-genericUpgrade linux-image-2.6.32-216-doveUpgrade linux-image-2.6.24-29-xenUpgrade linux-image-2.6.24-29-powerpcUpgrade linux-image-2.6.15-57-mckinley-smpUpgrade linux-image-2.6.32-28-genericUpgrade linux-image-2.6.24-29-mckinleyUpgrade linux-image-2.6.32-28-sparc64-smpUpgrade linux-image-2.6.35-25-powerpcUpgrade linux-image-2.6.15-57-sparc64Upgrade linux-image-2.6.32-28-virtualUpgrade linux-image-2.6.32-28-powerpcUpgrade linux-image-2.6.24-29-powerpc-smpUpgrade linux-image-2.6.24-29-powerpc64-smpUpgrade linux-image-2.6.32-28-serverUpgrade linux-image-2.6.32-28-386Upgrade linux-image-2.6.32-28-lpiaUpgrade linux-image-2.6.24-29-sparc64-smpUpgrade linux-image-2.6.35-903-omap4Upgrade linux-image-2.6.15-57-hppa32Upgrade linux-image-2.6.32-28-preemptUpgrade linux-image-2.6.15-57-hppa32-smpUpgrade linux-image-2.6.35-25-generic-paeUpgrade linux-image-2.6.32-28-generic-paeUpgrade linux-image-2.6.35-25-genericUpgrade linux-image-2.6.15-57-amd64-k8Upgrade linux-image-2.6.24-29-genericUpgrade linux-image-2.6.32-28-sparc64Upgrade linux-image-2.6.24-29-lpiacompatUpgrade linux-image-2.6.15-57-hppa64Upgrade linux-image-2.6.15-57-powerpc64-smpUpgrade linux-image-2.6.24-29-virtualUpgrade linux-image-2.6.15-57-686Upgrade linux-image-2.6.24-29-serverUpgrade linux-image-2.6.24-29-hppa64Upgrade linux-image-2.6.32-416-dove | Nov 8, 2024 | Dec 30, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub