CVE-2008-1675

La función bdx_ioctl_priv en el controlador tehuti (archivo tehuti.c) en el Kernel de Linux versiones 2.6.x anteriores a 2.6.25.1, no comprueba apropiadamente cierta información relacionada al tamaño del registro, que presenta un impacto no especificado y vectores de ataque locales, probablemente relacionados con la lectura y escritura de la memoria del Kernel.

It was discovered that PowerPC kernels did not correctly handle reporting certain system details. By requesting a specific set of information, a local attacker could cause a system crash resulting in a denial of service. A race condition was discovered between dnotify fcntl() and close() in the kernel. If a local attacker performed malicious dnotify requests, they could cause memory consumption leading to a denial of service, or possibly send arbitrary signals to any process. On SMP systems, a race condition existed in fcntl(). Local attackers could perform malicious locks, causing system crashes and leading to a denial of service. The tehuti network driver did not correctly handle certain IO functions. A local attacker could perform malicious requests to the driver, potentially accessing kernel memory, leading to privilege escalation or access to private system information.