The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Linux_kernel | Linux | * | 3.2.60 (excluding) |
Linux_kernel | Linux | 3.3 (including) | 3.4.92 (excluding) |
Linux_kernel | Linux | 3.5 (including) | 3.10.42 (excluding) |
Linux_kernel | Linux | 3.11 (including) | 3.12.22 (excluding) |
Linux_kernel | Linux | 3.13 (including) | 3.14.6 (excluding) |