The do_exit function in kernel/exit.c in the Linux kernel before 2.6.36.2 does not properly handle a KERNEL_DS get_fs value, which allows local users to bypass intended access_ok restrictions, overwrite arbitrary kernel memory locations, and gain privileges by leveraging a (1) BUG, (2) NULL pointer dereference, or (3) page fault, as demonstrated by vectors involving the clear_child_tid feature and the splice system call.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 3, 2010 |
| Suse | — | Upgrade um-host-kernelUpgrade kernel-vmipaeUpgrade kernel-sourceUpgrade kernel-paeUpgrade kernel-xenUpgrade kernel-iseries64Upgrade kernel-umUpgrade um-host-install-initrdUpgrade kernel-desktop-baseUpgrade kernel-vanillaUpgrade kernel-xen-develUpgrade kernel-traceUpgrade kernel-default-develUpgrade kernel-rt-develUpgrade brocade-bna-kmp-rtUpgrade kernel-ec2-develUpgrade kernel-ppc64Upgrade kernel-syms-rtUpgrade xen-kmpUpgrade kernel-s390Upgrade kernel-debug-develUpgrade kernel-s390-debugUpgrade kernel-desktopUpgrade kernel-pae-baseUpgrade kernel-kdumppaeUpgrade python-xmlUpgrade kernel-sn2Upgrade iscsitarget-kmp-rtUpgrade kernel-xen-baseUpgrade kernel-vmiUpgrade kernel-symsUpgrade ofed-kmp-rtUpgrade kernel-s390x-debugUpgrade kernel-64k-pagesizeUpgrade kernel-develUpgrade kernel-pmac64Upgrade kernel-debugUpgrade kernel-rt_trace-develUpgrade kernel-trace-baseUpgrade kernel-trace-develUpgrade kernel-pae-develUpgrade kernel-desktop-develUpgrade kernel-smpUpgrade preload-kmp-desktopUpgrade kernel-ec2-extraUpgrade kernel-debug-baseUpgrade kernel-defaultUpgrade preload-kmp-defaultUpgrade kernel-ec2-baseUpgrade SUSE-Linux-Enterprise-RT-releaseUpgrade kernel-s390xUpgrade kernel-rtUpgrade kernel-vanilla-baseUpgrade kernel-rt-baseUpgrade kernel-source-vanillaUpgrade kernel-xenpaeUpgrade kernel-rt_trace-baseUpgrade kernel-ec2Upgrade kernel-kdumpUpgrade kernel-bigsmpUpgrade kernel-pseries64Upgrade kernel-vmi-develUpgrade kernel-source-rtUpgrade kernel-default-baseUpgrade kernel-vmi-baseUpgrade kernel-vanilla-develUpgrade kernel-rt_trace | Feb 17, 2015 | Dec 30, 2010 |
| Ubuntu | — | Upgrade linux-image-2.6.15-57-686Upgrade linux-image-2.6.32-28-generic-paeUpgrade linux-image-2.6.15-57-mckinley-smpUpgrade linux-image-2.6.32-28-powerpcUpgrade linux-image-2.6.15-57-powerpc64-smpUpgrade linux-image-2.6.24-29-virtualUpgrade linux-image-2.6.24-29-mckinleyUpgrade linux-image-2.6.15-57-hppa32-smpUpgrade linux-image-2.6.24-29-powerpc64-smpUpgrade linux-image-2.6.15-57-hppa64Upgrade linux-image-2.6.35-25-powerpcUpgrade linux-image-2.6.15-57-amd64-genericUpgrade linux-image-2.6.32-28-sparc64-smpUpgrade linux-image-2.6.32-216-doveUpgrade linux-image-2.6.32-28-lpiaUpgrade linux-image-2.6.35-25-generic-paeUpgrade linux-image-2.6.15-57-hppa32Upgrade linux-image-2.6.24-29-hppa64Upgrade linux-image-2.6.24-29-powerpc-smpUpgrade linux-image-2.6.35-903-omap4Upgrade linux-image-2.6.32-28-preemptUpgrade linux-image-2.6.32-28-sparc64Upgrade linux-image-2.6.24-29-genericUpgrade linux-image-2.6.15-57-amd64-k8Upgrade linux-image-2.6.15-57-sparc64Upgrade linux-image-2.6.24-29-xenUpgrade linux-image-2.6.32-28-386Upgrade linux-image-2.6.32-416-doveUpgrade linux-image-2.6.24-29-sparc64-smpUpgrade linux-image-2.6.35-25-genericUpgrade linux-image-2.6.32-28-serverUpgrade linux-image-2.6.32-28-virtualUpgrade linux-image-2.6.24-29-serverUpgrade linux-image-2.6.24-29-lpiacompatUpgrade linux-image-2.6.32-28-genericUpgrade linux-image-2.6.24-29-powerpcUpgrade linux-image-2.6.24-29-itaniumUpgrade linux-image-2.6.15-57-itaniumUpgrade linux-image-2.6.15-57-mckinleyUpgrade linux-image-2.6.35-25-versatileUpgrade linux-image-2.6.15-57-386Upgrade linux-image-2.6.24-29-rtUpgrade linux-image-2.6.24-29-openvzUpgrade linux-image-2.6.35-25-omapUpgrade linux-image-2.6.15-57-serverUpgrade linux-image-2.6.32-28-powerpc-smpUpgrade linux-image-2.6.15-57-hppa64-smpUpgrade linux-image-2.6.32-312-ec2Upgrade linux-image-2.6.15-57-powerpcUpgrade linux-image-2.6.15-57-powerpc-smpUpgrade linux-image-2.6.35-25-virtualUpgrade linux-image-2.6.24-29-lpiaUpgrade linux-image-2.6.35-25-powerpc64-smpUpgrade linux-image-2.6.15-57-sparc64-smpUpgrade linux-image-2.6.15-57-amd64-xeonUpgrade linux-image-2.6.24-29-hppa32Upgrade linux-image-2.6.24-29-386Upgrade linux-image-2.6.35-25-powerpc-smpUpgrade linux-image-2.6.24-29-sparc64Upgrade linux-image-2.6.31-609-imx51Upgrade linux-image-2.6.15-57-server-bigironUpgrade linux-image-2.6.15-57-amd64-serverUpgrade linux-image-2.6.15-57-itanium-smpUpgrade linux-image-2.6.32-28-powerpc64-smpUpgrade linux-image-2.6.15-57-k7Upgrade linux-image-2.6.35-25-serverUpgrade linux-image-2.6.32-28-versatileUpgrade linux-image-2.6.32-28-ia64 | Nov 8, 2024 | Dec 30, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub