CVE - CVE-2012-3375

CVE-ID
CVE-2012-3375	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The epoll_ctl system call in fs/eventpoll.c in the Linux kernel before 3.2.24 does not properly handle ELOOP errors in EPOLL_CTL_ADD operations, which allows local users to cause a denial of service (file-descriptor consumption and system crash) via a crafted application that attempts to create a circular epoll dependency. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1083.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:1027237 URL:http://www.securitytracker.com/id?1027237 MISC:51164 URL:http://secunia.com/advisories/51164 MISC:USN-1529-1 URL:http://ubuntu.com/usn/usn-1529-1 MISC:[oss-security] 20120704 Re: CVE Request -- kernel: epoll: can leak file descriptors when returning -ELOOP URL:http://www.openwall.com/lists/oss-security/2012/07/04/2 MISC:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=13d518074a952d33d47c428419693f63389547e9 URL:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=13d518074a952d33d47c428419693f63389547e9 MISC:http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.24 URL:http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.24 MISC:https://bugzilla.redhat.com/show_bug.cgi?id=837502 URL:https://bugzilla.redhat.com/show_bug.cgi?id=837502 MISC:https://downloads.avaya.com/css/P8/documents/100165733 URL:https://downloads.avaya.com/css/P8/documents/100165733 MISC:https://github.com/torvalds/linux/commit/13d518074a952d33d47c428419693f63389547e9 URL:https://github.com/torvalds/linux/commit/13d518074a952d33d47c428419693f63389547e9
Assigning CNA
Red Hat, Inc.
Date Record Created
20120614	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20120614)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is a record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)