Revision history [back]

The futex_requeue function in kernel/futex.c in the Linux kernel before 4.14.15 might allow attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact by triggering a negative wake or requeue value. CVSS Score: 7.8HIGH local

Kernel-3.2 patch is available.

File affected: kernel-adaptation-sbj-3.4.108.20171107.1/kernel/futex.c lines 1378-1384

So the whole patch should look like:

@@ -1378,6 +1378,9 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags,
struct plist_head *head1;
struct futex_q *this, *next;

 +  if (nr_wake < 0 || nr_requeue < 0)
 +      return -EINVAL;
 +
if (requeue_pi) {
    /*
     * Requeue PI only works on two distinct uaddrs. This