CVE-2008-2372

Severity: medium (CVSS 4.9 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-07-02 · updated 2026-06-16
Weakness: CWE-20

Description

The Linux kernel 2.6.24 and 2.6.25 before 2.6.25.9 allows local users to cause a denial of service (memory consumption) via a large number of calls to the get_user_pages function, which lacks a ZERO_PAGE optimization and results in allocation of "useless newly zeroed pages."

Affected products

Linux kernel: 2.6.24, 2.6.25, 2.6.25.1, 2.6.25.2, 2.6.25.3, 2.6.25.4 (+4)

References

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=89f5b7da2a6bad2e84670422ab8192382a5aeb9f
http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.9
http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00007.html
http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00009.html
http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00012.html
http://new-ubuntu-news.blogspot.com/2008/06/re-pending-stable-kernel-security_25.html
http://secunia.com/advisories/30901
http://secunia.com/advisories/30982
http://secunia.com/advisories/31202
http://secunia.com/advisories/31628
http://secunia.com/advisories/32393
http://secunia.com/advisories/32485

Get alerted when CVE-2008-2372 or the next vulnerability affects your stack