The do_exit function in kernel/exit.c in the Linux kernel before 2.6.36.2 does not properly handle a KERNEL_DS get_fs value, which allows local users to bypass intended access_ok restrictions, overwrite arbitrary kernel memory locations, and gain privileges by leveraging a (1) BUG, (2) NULL pointer dereference, or (3) page fault, as demonstrated by vectors involving the clear_child_tid feature and the splice system call.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 3, 2010 |
| Suse | — | Upgrade kernel-default-baseUpgrade kernel-docsUpgrade kernel-ppc64-develUpgrade kernel-ppc64-baseUpgrade kernel-defaultUpgrade kernel-default-manUpgrade kernel-ppc64Upgrade kernel-default-develUpgrade kernel-pae-develUpgrade kernel-sourceUpgrade kernel-xen-develUpgrade kernel-pae-baseUpgrade kernel-xenUpgrade kernel-paeUpgrade kernel-traceUpgrade kernel-symsUpgrade kernel-trace-baseUpgrade kernel-xen-baseUpgrade kernel-trace-devel | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade linux-image-2.6.15-57-mckinley-smpUpgrade linux-image-2.6.24-29-hppa64Upgrade linux-image-2.6.24-29-powerpcUpgrade linux-image-2.6.15-57-sparc64Upgrade linux-image-2.6.32-28-powerpcUpgrade linux-image-2.6.24-29-mckinleyUpgrade linux-image-2.6.32-28-lpiaUpgrade linux-image-2.6.35-25-genericUpgrade linux-image-2.6.35-25-powerpcUpgrade linux-image-2.6.32-28-serverUpgrade linux-image-2.6.15-57-hppa64Upgrade linux-image-2.6.15-57-hppa32Upgrade linux-image-2.6.15-57-hppa32-smpUpgrade linux-image-2.6.24-29-genericUpgrade linux-image-2.6.32-28-sparc64Upgrade linux-image-2.6.24-29-powerpc64-smpUpgrade linux-image-2.6.32-28-sparc64-smpUpgrade linux-image-2.6.32-28-386Upgrade linux-image-2.6.35-25-generic-paeUpgrade linux-image-2.6.24-29-sparc64-smpUpgrade linux-image-2.6.32-216-doveUpgrade linux-image-2.6.15-57-amd64-genericUpgrade linux-image-2.6.15-57-powerpc64-smpUpgrade linux-image-2.6.15-57-686Upgrade linux-image-2.6.15-57-amd64-k8Upgrade linux-image-2.6.24-29-serverUpgrade linux-image-2.6.32-416-doveUpgrade linux-image-2.6.32-28-virtualUpgrade linux-image-2.6.24-29-powerpc-smpUpgrade linux-image-2.6.32-28-generic-paeUpgrade linux-image-2.6.24-29-xenUpgrade linux-image-2.6.32-28-genericUpgrade linux-image-2.6.24-29-lpiacompatUpgrade linux-image-2.6.32-28-preemptUpgrade linux-image-2.6.35-903-omap4Upgrade linux-image-2.6.24-29-virtualUpgrade linux-image-2.6.15-57-k7Upgrade linux-image-2.6.24-29-386Upgrade linux-image-2.6.15-57-powerpc-smpUpgrade linux-image-2.6.35-25-versatileUpgrade linux-image-2.6.32-28-versatileUpgrade linux-image-2.6.35-25-serverUpgrade linux-image-2.6.32-312-ec2Upgrade linux-image-2.6.32-28-powerpc64-smpUpgrade linux-image-2.6.32-28-ia64Upgrade linux-image-2.6.15-57-itaniumUpgrade linux-image-2.6.15-57-amd64-xeonUpgrade linux-image-2.6.35-25-virtualUpgrade linux-image-2.6.15-57-386Upgrade linux-image-2.6.15-57-hppa64-smpUpgrade linux-image-2.6.24-29-sparc64Upgrade linux-image-2.6.24-29-hppa32Upgrade linux-image-2.6.15-57-server-bigironUpgrade linux-image-2.6.15-57-sparc64-smpUpgrade linux-image-2.6.15-57-amd64-serverUpgrade linux-image-2.6.15-57-mckinleyUpgrade linux-image-2.6.15-57-itanium-smpUpgrade linux-image-2.6.24-29-itaniumUpgrade linux-image-2.6.24-29-openvzUpgrade linux-image-2.6.31-609-imx51Upgrade linux-image-2.6.15-57-serverUpgrade linux-image-2.6.35-25-powerpc-smpUpgrade linux-image-2.6.24-29-rtUpgrade linux-image-2.6.35-25-omapUpgrade linux-image-2.6.32-28-powerpc-smpUpgrade linux-image-2.6.35-25-powerpc64-smpUpgrade linux-image-2.6.24-29-lpiaUpgrade linux-image-2.6.15-57-powerpc | Nov 8, 2024 | Dec 30, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub