Description
The copy_shmid_to_user function in ipc/shm.c in the Linux kernel before 2.6.37-rc1 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via vectors related to the shmctl system call and the "old shm interface."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | linux-2.6 | 2.6.26-26lenny1 | DSA-2126-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | perf +14 | 2.6.32-71.14.1.el6 | RHSA-2011:0007 |
| RHEL 5 | kernel +12 | 2.6.18-238.el5 | RHSA-2011:0017 |
| RHEL 4 | kernel +10 | 2.6.9-89.35.1.EL | RHSA-2011:0162 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 1 | perf +10 | 2.6.33.7-rt29.47.el5rt | RHSA-2010:0958 |
Advisories 5
- RHSA-2011:0007 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2010:0958 Red Hat Security Advisory: kernel-rt security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2011:0017 Red Hat Security Advisory: Red Hat Enterprise Linux 5.6 kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2011:0162 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2126-1 linux-2.6 - several issues Debian Security (DSA / DLA) · Mar 9, 2026
References
- SUSE-SA:2011:004 vendor-advisory
- 42778 third-party-advisory
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3af54c9bd9e6f14f896aac1bb0e8405ae0bc7a44
- 20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console mailing-list
- RHSA-2011:0017 vendor-advisory
- 46397 third-party-advisory
- SUSE-SA:2011:001 vendor-advisory
- 42932 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=648656
- 45054 vdb-entry
- USN-1041-1 vendor-advisory
- RHSA-2011:0007 vendor-advisory
- ADV-2011-0124 vdb-entry
- SUSE-SA:2011:007 vendor-advisory
- SUSE-SA:2010:060 vendor-advisory
- ADV-2011-0298 vdb-entry
- RHSA-2010:0958 vendor-advisory
- MDVSA-2011:051 vendor-advisory
- [oss-security] 20101006 Re: CVE request: multiple kernel stack memory disclosures mailing-list
- 42963 third-party-advisory
- http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.37-rc1
- ADV-2011-0280 vdb-entry
- http://www.vmware.com/security/advisories/VMSA-2011-0012.html
- 42758 third-party-advisory
- 42884 third-party-advisory
- ADV-2011-0375 vdb-entry
- [linux-kernel] 20101006 [PATCH] ipc: initialize structure memory to zero for shmctl mailing-list
- 42890 third-party-advisory
- RHSA-2011:0162 vendor-advisory
- ADV-2011-0012 vdb-entry
- SUSE-SA:2011:008 vendor-advisory
- ADV-2011-0168 vdb-entry
- MDVSA-2011:029 vendor-advisory
- [oss-security] 20101025 Re: CVE request: multiple kernel stack memory disclosures mailing-list
- USN-1057-1 vendor-advisory
- 43291 third-party-advisory
- ADV-2011-0070 vdb-entry
- 43161 third-party-advisory
- DSA-2126 vendor-advisory