CVE-2008-2729

Severity: medium (CVSS 4.9 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-06-30 · updated 2026-06-16
Weakness: CWE-200

Description

arch/x86_64/lib/copy_user.S in the Linux kernel before 2.6.19 on some AMD64 systems does not erase destination memory locations after an exception during kernel memory copy, which allows local users to obtain sensitive information.

Affected products

Linux kernel: before 2.6.19 — fixed in 2.6.19

How to fix

Upgrade to a fixed version: Linux kernel 2.6.19. Check the vendor advisory for mitigations.

References

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=3022d734a54cbd2b65eea9a024564821101b4a9a%3Bhp=f0f4c3432e5e1087b3a8c0e6bd4113d3c37497ff
http://rhn.redhat.com/errata/RHSA-2008-0508.html
http://secunia.com/advisories/30849
http://secunia.com/advisories/30850
http://secunia.com/advisories/31107
http://secunia.com/advisories/31551
http://secunia.com/advisories/31628
http://www.debian.org/security/2008/dsa-1630
http://www.mandriva.com/security/advisories?name=MDVSA-2008:174
http://www.redhat.com/support/errata/RHSA-2008-0519.html
http://www.redhat.com/support/errata/RHSA-2008-0585.html
http://www.securityfocus.com/bid/29943

Get alerted when CVE-2008-2729 or the next vulnerability affects your stack