Description
The fuse_ioctl_copy_user function in the ioctl handler in fs/fuse/file.c in the Linux kernel 2.6.29-rc1 through 2.6.30.y uses the wrong variable in an argument to the kunmap function, which allows local users to cause a denial of service (panic) via unknown vectors.
References
- 37453 vdb-entry
- FEDORA-2009-13694 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=549400
- 37928 third-party-advisory
- [oss-security] 20091223 CVE request - kernel: fuse_ioctl_copy_user() dos mailing-list
- 61335 vdb-entry