The get_instantiation_keyring function in security/keys/keyctl.c in the KEYS subsystem in the Linux kernel before 2.6.32-rc5 does not properly maintain the reference count of a keyring, which allows local users to gain privileges or cause a denial of service (OOPS) via vectors involving calls to this function without specifying a keyring by ID, as demonstrated by a series of keyctl request2 and keyctl list commands.
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
| Link | Tags |
|---|---|
| http://marc.info/?l=oss-security&m=125619420905341&w=2 | mailing list |
| http://www.ubuntu.com/usn/usn-864-1 | vendor advisory |
| http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.html | vendor advisory |
| http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=21279cfa107af07ef985539ac0de2152b9cba5f5 | |
| http://twitter.com/spendergrsec/statuses/4916661870 | |
| http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.32-rc5 | vendor advisory |
| http://marc.info/?l=oss-security&m=125624091417161&w=2 | mailing list |
| http://secunia.com/advisories/37086 | third party advisory vendor advisory |
| http://secunia.com/advisories/38017 | third party advisory |