| Description: | The copy_to_user_auth function in net/xfrm/xfrm_user.c in the Linux kernel before 3.6 uses an incorrect C library function for copying a string, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability. Mathias Krause discovered an information leak in the Linux kernel's xfrm_user copy_to_user_auth function. A local user could exploit this flaw to examine parts of kernel heap memory.
|