NetSight
IP …
medium4.7Public exploit code

CVE-2009-1961

The inode double locking code in fs/ocfs2/file.c in the Linux kernel 2.6.30 before 2.6.30-rc3, 2.6.27 before 2.6.27.24, 2.6.29 before 2.6.29.4, and possibly ot…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The inode double locking code in fs/ocfs2/file.c in the Linux kernel 2.6.30 before 2.6.30-rc3, 2.6.27 before 2.6.27.24, 2.6.29 before 2.6.29.4, and possibly other versions down to 2.6.19 allows local users to cause a denial of service (prevention of file creation and removal) via a series of splice system calls that trigger a deadlock between the generic_file_splice_write, splice_from_pipe, and ocfs2_file_splice_write functions.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
through 2.6.19
from 2.6.27 before 2.6.27.24
from 2.6.29 before 2.6.29.4
Version 2.6.30
DebianDebian Linux
Version 4.0
CanonicalUbuntu Linux
Versions 6.06, 8.04, 8.10, 9.04
OpensuseOpensuse
Versions 10.3, 11.1
SuseLinux Enterprise
Version 11.0
SuseLinux Enterprise Desktop
Version 11
SuseLinux Enterprise Server
Version 11

Weakness classification

CWE-667

References