[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <4BC65FD5.9060800@redhat.com>
Date: Thu, 15 Apr 2010 08:37:41 +0800
From: Eugene Teo <eugene@...hat.com>
To: oss-security@...ts.openwall.com
CC: Michael Gilbert <michael.s.gilbert@...il.com>, coley@...re.org
Subject: CVE request: kernel: tty: release_one_tty() forgets to put pids
On 04/15/2010 08:23 AM, Michael Gilbert wrote:
> On Wed, 14 Apr 2010 11:20:00 +0800 Eugene Teo wrote:
>
>> 2) tty: release_one_tty() forgets to put pids
>> https://bugzilla.redhat.com/show_bug.cgi?id=582076
>> http://git.kernel.org/linus/6da8d866d0d39e9509ff826660f6a86a6757c966
>> Not sure this issue can be triggered by a non-privileged user.
>
> this one should get a CVE id i think. looking at only two data points
> (2.6.26 and 2.6.32), i've found the vulnerable code present in both.
> if i'm not mistaken, redhat has had supported releases in that range.
Was discussing this with another colleague, that it seems possible to
trigger this issue with a non-privileged user. And yes, I agree that
this should have a CVE name assigned. Thanks.
Eugene
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
