Linux Kernel FASYNC Use-After-Free Privilege Escalation Vulnerability

Secunia ID	SA38199
CVE-ID	CVE-2009-4141
Release Date	14 Jan 2010
Last Change	19 Jan 2010
Criticality	Less Critical
Solution Status	Vendor Patch
Where	Local system
Impact	Privilege escalation This covers vulnerabilities where a user is able to conduct certain tasks with the privileges of other users or administrative users. This typically includes cases where a local user on a client or server system can gain access to the administrator or root account thus taking full control of the system.
Description	A vulnerability has been reported in the Linux Kernel, which can be exploited by malicious, local users to gain escalated privileges. The vulnerability is caused due to a use-after-free error within the handling of file descriptors with the FASYNC flag set. This can be exploited to e.g. cause a crash or execute arbitrary code with kernel privileges. The vulnerability is reported in version 2.6.28 and later.
Solution	Update to version 2.6.31.12 or 2.6.32.4.
Reported by	Tavis Ormandy, Google.
Original Advisory	http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0252.html http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=log;h=53281b6d34d44308372d16acb7fb5327609f68b6