CVE-2012-4398
published 2013-02-18CVE-2012-4398: The __request_module function in kernel/kmod.c in the Linux kernel before 3.4 does not set a certain killable attribute, which allows local users to cause a…
PriorityP415medium4.9CVSS 2.0
AVLACLAuNCNINAC
EPSS
0.41%
34.0th percentile
The __request_module function in kernel/kmod.c in the Linux kernel before 3.4 does not set a certain killable attribute, which allows local users to cause a denial of service (memory consumption) via a crafted application.
Affected
103 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 3.2.35-1 (bookworm) | linux 3.2.35-1 (bookworm) |
| linux | linux_kernel | <= 3.4 | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
CVSS provenance
nvdv2.04.9MEDIUMAV:L/AC:L/Au:N/C:N/I:N/A:C
osv4.9MEDIUM
vendor_debian4.9LOW
vendor_redhat4.9MEDIUM
vendor_ubuntu4.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2012-05-18·CVSS 4.9
CVE-2011-4086 [MEDIUM] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was found in the Linux's kernels ext4 file system when mounted with
a journal. A local, unprivileged user could exploit this flaw to cause a
denial of service. (CVE-2011-4086)
A flaw was discovered in the Linux kernel's cifs file system. An
unprivileged local user could exploit this flaw to crash the system leading
to a denial of service. (CVE-2012-1090)
H. Peter Anvin reported a flaw in the Linux kernel that could crash the
system. A local user could exploit this flaw to crash the system.
(CVE-2012-1097)
A flaw was discovered in the Linux kernel's cgroups subset. A local
attacker could use this flaw to crash the system. (CVE-2012-1146)
A flaw was found in the Linux kernel's
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2012-05-08·CVSS 4.9
CVE-2011-4086 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was found in the Linux's kernels ext4 file system when mounted with
a journal. A local, unprivileged user could exploit this flaw to cause a
denial of service. (CVE-2011-4086)
A flaw was discovered in the Linux kernel's cifs file system. An
unprivileged local user could exploit this flaw to crash the system leading
to a denial of service. (CVE-2012-1090)
A flaw was found in the Linux kernel's ext4 file system when mounting a
corrupt filesystem. A user-assisted remote attacker could exploit this flaw
to cause a denial of service. (CVE-2012-2100)
Tetsuo Handa reported a flaw in the OOM (out of memory) killer of the Linux
kernel. A local unprivileged user can exploit this flaw to cause s
Ubuntu
Linux kernel (Natty backport) vulnerabilities
vendor_ubuntu·2012-05-08·CVSS 4.9
CVE-2011-4086 [MEDIUM] Linux kernel (Natty backport) vulnerabilities
Title: Linux kernel (Natty backport) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was found in the Linux's kernels ext4 file system when mounted with
a journal. A local, unprivileged user could exploit this flaw to cause a
denial of service. (CVE-2011-4086)
Sasha Levin discovered a flaw in the permission checking for device
assignments requested via the kvm ioctl in the Linux kernel. A local user
could use this flaw to crash the system causing a denial of service.
(CVE-2011-4347)
Stephan Bärwolf discovered a flaw in the KVM (kernel-based virtual
machine) subsystem of the Linux kernel. A local unprivileged user can crash
use this flaw to crash VMs causing a deny of service. (CVE-2012-0045)
A flaw was discovered in the Linux kernel's cifs file system
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2012-05-01·CVSS 4.9
CVE-2012-4398 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was found in the Linux's kernels ext4 file system when mounted with
a journal. A local, unprivileged user could exploit this flaw to cause a
denial of service. (CVE-2011-4086)
Sasha Levin discovered a flaw in the permission checking for device
assignments requested via the kvm ioctl in the Linux kernel. A local user
could use this flaw to crash the system causing a denial of service.
(CVE-2011-4347)
Stephan Bärwolf discovered a flaw in the KVM (kernel-based virtual
machine) subsystem of the Linux kernel. A local unprivileged user can crash
use this flaw to crash VMs causing a deny of service. (CVE-2012-0045)
A flaw was discovered in the Linux kernel's cifs file system. An
unprivileged
Ubuntu
Linux kernel (Oneiric backport) vulnerabilities
vendor_ubuntu·2012-05-01·CVSS 4.9
CVE-2011-4086 [MEDIUM] Linux kernel (Oneiric backport) vulnerabilities
Title: Linux kernel (Oneiric backport) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was found in the Linux's kernels ext4 file system when mounted with
a journal. A local, unprivileged user could exploit this flaw to cause a
denial of service. (CVE-2011-4086)
Sasha Levin discovered a flaw in the permission checking for device
assignments requested via the kvm ioctl in the Linux kernel. A local user
could use this flaw to crash the system causing a denial of service.
(CVE-2011-4347)
Stephan Bärwolf discovered a flaw in the KVM (kernel-based virtual
machine) subsystem of the Linux kernel. A local unprivileged user can crash
use this flaw to crash VMs causing a deny of service. (CVE-2012-0045)
A flaw was discovered in the Linux kernel's cifs file syst
Ubuntu
Linux kernel (EC2) vulnerabilities
vendor_ubuntu·2012-04-24·CVSS 4.0
CVE-2011-4347 [MEDIUM] Linux kernel (EC2) vulnerabilities
Title: Linux kernel (EC2) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Sasha Levin discovered a flaw in the permission checking for device
assignments requested via the kvm ioctl in the Linux kernel. A local user
could use this flaw to crash the system causing a denial of service.
(CVE-2011-4347)
Stephan Bärwolf discovered a flaw in the KVM (kernel-based virtual
machine) subsystem of the Linux kernel. A local unprivileged user can crash
use this flaw to crash VMs causing a deny of service. (CVE-2012-0045)
A flaw was discovered in the Linux kernel's cifs file system. An
unprivileged local user could exploit this flaw to crash the system leading
to a denial of service. (CVE-2012-1090)
H. Peter Anvin reported a flaw in the Linux kernel that could crash the
s
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2012-04-24·CVSS 4.0
CVE-2011-4347 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Sasha Levin discovered a flaw in the permission checking for device
assignments requested via the kvm ioctl in the Linux kernel. A local user
could use this flaw to crash the system causing a denial of service.
(CVE-2011-4347)
Stephan Bärwolf discovered a flaw in the KVM (kernel-based virtual
machine) subsystem of the Linux kernel. A local unprivileged user can crash
use this flaw to crash VMs causing a deny of service. (CVE-2012-0045)
A flaw was discovered in the Linux kernel's cifs file system. An
unprivileged local user could exploit this flaw to crash the system leading
to a denial of service. (CVE-2012-1090)
H. Peter Anvin reported a flaw in the Linux kernel that could crash the
system.
Red Hat
kernel: request_module() OOM local DoS
vendor_redhat·2012-03-23·CVSS 4.9
CVE-2012-4398 [MEDIUM] kernel: request_module() OOM local DoS
kernel: request_module() OOM local DoS
The __request_module function in kernel/kmod.c in the Linux kernel before 3.4 does not set a certain killable attribute, which allows local users to cause a denial of service (memory consumption) via a crafted application.
Statement: This issue does affect the versions of the Linux kernel as shipped with Red
Hat Enterprise Linux 5, 6 and Red Hat Enteprise MRG. Future kernel updates may address this flaw.
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Debian
CVE-2012-4398: linux - The __request_module function in kernel/kmod.c in the Linux kernel before 3.4 do...
vendor_debian·2012·CVSS 4.9
CVE-2012-4398 [MEDIUM] CVE-2012-4398: linux - The __request_module function in kernel/kmod.c in the Linux kernel before 3.4 do...
The __request_module function in kernel/kmod.c in the Linux kernel before 3.4 does not set a certain killable attribute, which allows local users to cause a denial of service (memory consumption) via a crafted application.
Scope: local
bookworm: resolved (fixed in 3.2.35-1)
bullseye: resolved (fixed in 3.2.35-1)
forky: resolved (fixed in 3.2.35-1)
sid: resolved (fixed in 3.2.35-1)
trixie: resolved (fixed in 3.2.35-1)
GHSA
GHSA-7qcc-4wfp-2fj5: The __request_module function in kernel/kmod
ghsa_unreviewed·2022-05-17
CVE-2012-4398 [MEDIUM] CWE-20 GHSA-7qcc-4wfp-2fj5: The __request_module function in kernel/kmod
The __request_module function in kernel/kmod.c in the Linux kernel before 3.4 does not set a certain killable attribute, which allows local users to cause a denial of service (memory consumption) via a crafted application.
Kernel
kthread: make kthread_create() killable
kernel_security·2013-11-12·CVSS 4.9
CVE-2012-4398 [MEDIUM] kthread: make kthread_create() killable
kthread: make kthread_create() killable
Any user process callers of wait_for_completion() except global init
process might be chosen by the OOM killer while waiting for completion()
call by some other process which does memory allocation. See
CVE-2012-4398 "kernel: request_module() OOM local DoS" can happen.
When such users are chosen by the OOM killer when they are waiting for
completion() in TASK_UNINTERRUPTIBLE, the system will be kept stressed
due to memory starvation because the OOM killer cannot kill such users.
kthread_create() is one of such users and this patch fixes the problem
for kthreadd by making kthread_create() killable - the same approach
used for fixing CVE-2012-4398.
Signed-off-by: Tetsuo Handa
Cc: Oleg Nesterov
Acked-by: David Rientjes
Signed-off-by: Andrew Morton
S
OSV
CVE-2012-4398: The __request_module function in kernel/kmod
osv·2013-02-18·CVSS 4.9
CVE-2012-4398 [MEDIUM] CVE-2012-4398: The __request_module function in kernel/kmod
The __request_module function in kernel/kmod.c in the Linux kernel before 3.4 does not set a certain killable attribute, which allows local users to cause a denial of service (memory consumption) via a crafted application.
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.htmlhttp://lkml.indiana.edu/hypermail/linux/kernel/1202.0/03340.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0223.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1348.htmlhttp://secunia.com/advisories/55077http://www.kernel.org/pub/linux/kernel/v3.x/linux-3.4.tar.bz2http://www.openwall.com/lists/oss-security/2012/09/02/3http://www.securityfocus.com/bid/55361https://bugzilla.redhat.com/show_bug.cgi?id=853474http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.htmlhttp://lkml.indiana.edu/hypermail/linux/kernel/1202.0/03340.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0223.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1348.htmlhttp://secunia.com/advisories/55077http://www.kernel.org/pub/linux/kernel/v3.x/linux-3.4.tar.bz2http://www.openwall.com/lists/oss-security/2012/09/02/3http://www.securityfocus.com/bid/55361https://bugzilla.redhat.com/show_bug.cgi?id=853474
2013-02-18
Published