The install_special_mapping function in mm/mmap.c in the Linux kernel before 2.6.37-rc6 does not make an expected security_file_mmap function call, which allows local users to bypass intended mmap_min_addr restrictions and possibly conduct NULL pointer dereference attacks via a crafted assembly-language application.

The install_special_mapping function in mm/mmap.c in the Linux kernel before 2.6.37-rc6 does not make an expected security_file_mmap function call, which allows local users to bypass intended mmap_min_addr restrictions and possibly conduct NULL pointer dereference attacks via a crafted assembly-language application.

kernel: net/sched/act_police.c infoleak kernel: L2TP send buffer allocation size overflows kernel: bio: integer overflow page count when mapping/copying user data kernel: panic when submitting certain 0-length I/O requests kernel: possible kernel oops from user MSS kernel: missing tty ops write function presence check in hci_uart_tty_open() kernel: posix-cpu-timers: workaround to suppress the problems with mt exec kernel: unix socket local dos kernel: inotify memory leak kernel: install_special_mapping skips security_file_mmap check kernel: local privilege escalation via /sys/kernel/debug/acpi/custom_method kernel: CAN info leak kernel: orinoco: fix TKIP countermeasure behaviour kernel: IB/uverbs: Handle large number of entries in poll CQ kernel: heap contents leak for CAP_NET_ADMIN via ethtool ioctl kernel: iowarrior usb device heap overflow kernel: panic when submitting certain 0-length I/O requests kernel: av7110 negative array offset kernel: IB/uverbs: Handle large number of entries in poll CQ

Security update for Kernel