Description
arch/x86_64/lib/copy_user.S in the Linux kernel before 2.6.19 on some AMD64 systems does not erase destination memory locations after an exception during kernel memory copy, which allows local users to obtain sensitive information.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | fai-kernels | 1.17+etch.22etch2 | DSA-1630-1 |
| Debian 4.0 | linux-2.6 | 2.6.18.dfsg.1-22etch2 | DSA-1630-1 |
| Debian 4.0 | user-mode-linux | 2.6.18-1um-2etch.22etch2 | DSA-1630-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +12 | 2.6.18-92.1.6.el5 | RHSA-2008:0519 |
| RHEL 4 | kernel +10 | 2.6.9-67.0.20.EL | RHSA-2008:0508 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 1 | kernel-rt +9 | 2.6.24.7-74.el5rt | RHSA-2008:0585 |
Advisories 4
- RHSA-2008:0585 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2008:0519 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0508 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1630-1 fai-kernels linux-2.6 user-mode-linux - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=3022d734a54cbd2b65eea9a024564821101b4a9a%3Bhp=f0f4c3432e5e1087b3a8c0e6bd4113d3c37497ff
- DSA-1630 vendor-advisory
- RHSA-2008:0519 vendor-advisory
- linux-kernel-destination-info-disclosure(43558) vdb-entry
- oval:org.mitre.oval:def:11571 vdb-entry signature
- 30849 third-party-advisory
- 1020364 vdb-entry
- 31551 third-party-advisory
- 30850 third-party-advisory
- RHSA-2008:0585 vendor-advisory
- MDVSA-2008:174 vendor-advisory
- 31107 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=451271
- 29943 vdb-entry
- 31628 third-party-advisory
- USN-625-1 vendor-advisory
- RHSA-2008:0508 vendor-advisory