CVE-2004-0077 The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number....
HighCVSS 7.2
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat bigmem kernel | = 2.4.20-8 | No fix listed |
| redhat/kernel | = 2.4.20-8 | No fix listed |
| redhat kernel doc | = 2.4.20-8 | No fix listed |
| redhat kernel source | = 2.4.20-8 | No fix listed |
| Linux kernel | = 2.2.0 | No fix listed |
| Linux kernel | = 2.2.1 | No fix listed |
| Linux kernel | = 2.2.2 | No fix listed |
| Linux kernel | = 2.2.3 | No fix listed |
| Linux kernel | = 2.2.4 | No fix listed |
| Linux kernel | = 2.2.5 | No fix listed |
| Linux kernel | = 2.2.6 | No fix listed |
| Linux kernel | = 2.2.7 | No fix listed |
| Linux kernel | = 2.2.8 | No fix listed |
| Linux kernel | = 2.2.9 | No fix listed |
| Linux kernel | = 2.2.10 | No fix listed |
| Linux kernel | = 2.2.11 | No fix listed |
| Linux kernel | = 2.2.12 | No fix listed |
| Linux kernel | = 2.2.13 | No fix listed |
| Linux kernel | = 2.2.14 | No fix listed |
| Linux kernel | = 2.2.15 | No fix listed |
| Linux kernel | = 2.2.15-pre16 | No fix listed |
| Linux kernel | = 2.2.15_pre20 | No fix listed |
| Linux kernel | = 2.2.16 | No fix listed |
| Linux kernel | = 2.2.16-pre6 | No fix listed |
| Linux kernel | = 2.2.17 | No fix listed |
Show 81 more
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux kernel | = 2.2.18 | No fix listed |
| Linux kernel | = 2.2.19 | No fix listed |
| Linux kernel | = 2.2.20 | No fix listed |
| Linux kernel | = 2.2.21 | No fix listed |
| Linux kernel | = 2.2.22 | No fix listed |
| Linux kernel | = 2.2.23 | No fix listed |
| Linux kernel | = 2.2.24 | No fix listed |
| Linux kernel | = 2.4.0 | No fix listed |
| Linux kernel | = 2.4.0-test1 | No fix listed |
| Linux kernel | = 2.4.0-test10 | No fix listed |
| Linux kernel | = 2.4.0-test11 | No fix listed |
| Linux kernel | = 2.4.0-test12 | No fix listed |
| Linux kernel | = 2.4.0-test2 | No fix listed |
| Linux kernel | = 2.4.0-test3 | No fix listed |
| Linux kernel | = 2.4.0-test4 | No fix listed |
| Linux kernel | = 2.4.0-test5 | No fix listed |
| Linux kernel | = 2.4.0-test6 | No fix listed |
| Linux kernel | = 2.4.0-test7 | No fix listed |
| Linux kernel | = 2.4.0-test8 | No fix listed |
| Linux kernel | = 2.4.0-test9 | No fix listed |
| Linux kernel | = 2.4.1 | No fix listed |
| Linux kernel | = 2.4.2 | No fix listed |
| Linux kernel | = 2.4.3 | No fix listed |
| Linux kernel | = 2.4.4 | No fix listed |
| Linux kernel | = 2.4.5 | No fix listed |
| Linux kernel | = 2.4.6 | No fix listed |
| Linux kernel | = 2.4.7 | No fix listed |
| Linux kernel | = 2.4.8 | No fix listed |
| Linux kernel | = 2.4.9 | No fix listed |
| Linux kernel | = 2.4.10 | No fix listed |
| Linux kernel | = 2.4.11 | No fix listed |
| Linux kernel | = 2.4.12 | No fix listed |
| Linux kernel | = 2.4.13 | No fix listed |
| Linux kernel | = 2.4.14 | No fix listed |
| Linux kernel | = 2.4.15 | No fix listed |
| Linux kernel | = 2.4.16 | No fix listed |
| Linux kernel | = 2.4.17 | No fix listed |
| Linux kernel | = 2.4.18 | No fix listed |
| Linux kernel | = 2.4.18-pre1 | No fix listed |
| Linux kernel | = 2.4.18-pre2 | No fix listed |
| Linux kernel | = 2.4.18-pre3 | No fix listed |
| Linux kernel | = 2.4.18-pre4 | No fix listed |
| Linux kernel | = 2.4.18-pre5 | No fix listed |
| Linux kernel | = 2.4.18-pre6 | No fix listed |
| Linux kernel | = 2.4.18-pre7 | No fix listed |
| Linux kernel | = 2.4.18-pre8 | No fix listed |
| Linux kernel | = 2.4.19 | No fix listed |
| Linux kernel | = 2.4.19-pre1 | No fix listed |
| Linux kernel | = 2.4.19-pre2 | No fix listed |
| Linux kernel | = 2.4.19-pre3 | No fix listed |
| Linux kernel | = 2.4.19-pre4 | No fix listed |
| Linux kernel | = 2.4.19-pre5 | No fix listed |
| Linux kernel | = 2.4.19-pre6 | No fix listed |
| Linux kernel | = 2.4.20 | No fix listed |
| Linux kernel | = 2.4.21 | No fix listed |
| Linux kernel | = 2.4.21-pre1 | No fix listed |
| Linux kernel | = 2.4.21-pre4 | No fix listed |
| Linux kernel | = 2.4.21-pre7 | No fix listed |
| Linux kernel | = 2.4.22 | No fix listed |
| Linux kernel | = 2.4.23 | No fix listed |
| Linux kernel | = 2.4.23-pre9 | No fix listed |
| Linux kernel | = 2.4.24 | No fix listed |
| Linux kernel | = 2.6.0 | No fix listed |
| Linux kernel | = 2.6.0-test1 | No fix listed |
| Linux kernel | = 2.6.0-test10 | No fix listed |
| Linux kernel | = 2.6.0-test11 | No fix listed |
| Linux kernel | = 2.6.0-test2 | No fix listed |
| Linux kernel | = 2.6.0-test3 | No fix listed |
| Linux kernel | = 2.6.0-test4 | No fix listed |
| Linux kernel | = 2.6.0-test5 | No fix listed |
| Linux kernel | = 2.6.0-test6 | No fix listed |
| Linux kernel | = 2.6.0-test7 | No fix listed |
| Linux kernel | = 2.6.0-test8 | No fix listed |
| Linux kernel | = 2.6.0-test9 | No fix listed |
| Linux kernel | = 2.6.1-rc1 | No fix listed |
| Linux kernel | = 2.6.1-rc2 | No fix listed |
| Linux kernel | = 2.6.2 | No fix listed |
| Linux kernel | = 2.6_test9_cvs | No fix listed |
| netwosix linux | = 1.0 | No fix listed |
| trustix secure linux | = 1.5 | No fix listed |
| trustix secure linux | = 2.0 | No fix listed |
References
- 20040218 Second critical mremap() bug found in all Linux kernels mailing-list
- CLA-2004:820 vendor-advisory
- FEDORA-2004-079 vendor-advisory
- MDKSA-2004:015 vendor-advisory
- isec.pl
- 20040218 Second critical mremap() bug found in all Linux kernels mailing-list
- 2004-0007 vendor-advisory
- 2004-0008 vendor-advisory
- GLSA-200403-02 patch vendor-advisory
- O-082 government-resource third-party-advisory
- DSA-438 vendor-advisory
- DSA-439 patch vendor-advisory
- DSA-440 vendor-advisory
- DSA-441 vendor-advisory
- DSA-442 vendor-advisory
- DSA-444 vendor-advisory
- DSA-450 vendor-advisory
- DSA-453 vendor-advisory
- DSA-454 vendor-advisory
- DSA-456 vendor-advisory
- DSA-466 vendor-advisory
- DSA-470 vendor-advisory
- DSA-475 vendor-advisory
- DSA-514 vendor-advisory
- VU#981222 third-party-advisory us-government-resource
- SuSE-SA:2004:005 vendor-advisory
- 3986 vdb-entry
- RHSA-2004:065 vendor-advisory
- RHSA-2004:066 vendor-advisory
- RHSA-2004:069 vendor-advisory
- RHSA-2004:106 vendor-advisory
- 9686 exploit patch vdb-entry vendor-advisory
- SSA:2004-049 vendor-advisory
- linux-mremap-gain-privileges(15244) vdb-entry
- oval:org.mitre.oval:def:825 signature vdb-entry
- oval:org.mitre.oval:def:837 signature vdb-entry