A weakness and a vulnerability have been reported in the Linux Kernel, which can be exploited by malicious, local users to cause a DoS (Denial of Service) and disclose potentially sensitive information.

1) The vulnerability is caused due to the "processcompl()" and "processcompl_compat()" functions in drivers/usb/core/devio.c potentially returning kernel memory content to userspace processes, which can be exploited to e.g. disclose potentially sensitive information.

2) The weakness is caused due to a memory leak when handling certain error cases in drivers/usb/core/devio.c, which can be exploited to e.g. cause a DoS due to memory exhaustion.

Note: Successful exploitation requires access to USB userspace devices.

Solution
Update to version 2.6.32.9.

Provided and/or discovered by
1) Marcus Meissner, SUSE
2) Reported by the vendor.

Changelog
Further details available in Customer Area

Original Advisory
1) http://www.openwall.com/lists/oss-security/2010/02/17/1
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=d4a4683ca054ed9917dfc9e3ff0f7ecf74ad90d6
2) http://www.openwall.com/lists/oss-security/2010/02/17/2
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=ddeee0b2eec2a51b0712b04de4b39e7bec892a53

Deep Links
Links available in Customer Area