CVE-2008-5029

Published: 10 November 2008

The __scm_destroy function in net/core/scm.c in the Linux kernel 2.6.27.4, 2.6.26, and earlier makes indirect recursive calls to itself through calls to the fput function, which allows local users to cause a denial of service (panic) via vectors related to sending an SCM_RIGHTS message through a UNIX domain socket and closing file descriptors.

From the Ubuntu Security Team

It was discovered that the Unix Socket handler did not correctly process the SCM_RIGHTS message. A local attacker could make a malicious socket request that would crash the system, leading to a denial of service.

Notes

raised priority due to public PoC

Status

References

• http://www.milw0rm.com/exploits/7091
• https://ubuntu.com/security/notices/USN-679-1
• https://www.cve.org/CVERecord?id=CVE-2008-5029
• NVD
• Launchpad
• Debian