National Cyber-Alert System

Vulnerability Summary for CVE-2004-0077

Overview

The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#981222

Name: VU#981222

Hyperlink:http://www.kb.cert.org/vuls/id/981222

External Source: BID

Name: 9686

Type: Advisory; Patch Information

Hyperlink:http://www.securityfocus.com/bid/9686

External Source: DEBIAN

Name: DSA-439

Type: Advisory; Patch Information

Hyperlink:http://www.debian.org/security/2004/dsa-439

External Source: GENTOO

Name: GLSA-200403-02

Type: Advisory; Patch Information

Hyperlink:http://security.gentoo.org/glsa/glsa-200403-02.xml

External Source: XF

Name: linux-mremap-gain-privileges(15244)

Type: Advisory

Hyperlink:http://xforce.iss.net/xforce/xfdb/15244

External Source: BUGTRAQ

Name: 20040218 Second critical mremap() bug found in all Linux kernels

Type: Advisory

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=107711762014175&w=2

External Source: MISC

Name: http://isec.pl/vulnerabilities/isec-0014-mremap-unmap.txt

Hyperlink:http://isec.pl/vulnerabilities/isec-0014-mremap-unmap.txt

External Source: SLACKWARE

Name: SSA:2004-049

Hyperlink:http://www.slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.404734

External Source: REDHAT

Name: RHSA-2004:106

Hyperlink:http://www.redhat.com/support/errata/RHSA-2004-106.html

External Source: REDHAT

Name: RHSA-2004:069

Hyperlink:http://www.redhat.com/support/errata/RHSA-2004-069.html

External Source: REDHAT

Name: RHSA-2004:066

Hyperlink:http://www.redhat.com/support/errata/RHSA-2004-066.html

External Source: REDHAT

Name: RHSA-2004:065

Hyperlink:http://www.redhat.com/support/errata/RHSA-2004-065.html

External Source: OSVDB

Name: 3986

Hyperlink:http://www.osvdb.org/3986

External Source: SUSE

Name: SuSE-SA:2004:005

Hyperlink:http://www.novell.com/linux/security/advisories/2004_05_linux_kernel.html

External Source: DEBIAN

Name: DSA-514

Hyperlink:http://www.debian.org/security/2004/dsa-514

External Source: DEBIAN

Name: DSA-475

Hyperlink:http://www.debian.org/security/2004/dsa-475

External Source: DEBIAN

Name: DSA-470

Hyperlink:http://www.debian.org/security/2004/dsa-470

External Source: DEBIAN

Name: DSA-466

Hyperlink:http://www.debian.org/security/2004/dsa-466

External Source: DEBIAN

Name: DSA-456

Hyperlink:http://www.debian.org/security/2004/dsa-456

External Source: DEBIAN

Name: DSA-454

Hyperlink:http://www.debian.org/security/2004/dsa-454

External Source: DEBIAN

Name: DSA-453

Hyperlink:http://www.debian.org/security/2004/dsa-453

External Source: DEBIAN

Name: DSA-450

Hyperlink:http://www.debian.org/security/2004/dsa-450

External Source: DEBIAN

Name: DSA-444

Hyperlink:http://www.debian.org/security/2004/dsa-444

External Source: DEBIAN

Name: DSA-442

Hyperlink:http://www.debian.org/security/2004/dsa-442

External Source: DEBIAN

Name: DSA-441

Hyperlink:http://www.debian.org/security/2004/dsa-441

External Source: DEBIAN

Name: DSA-440

Hyperlink:http://www.debian.org/security/2004/dsa-440

External Source: DEBIAN

Name: DSA-438

Hyperlink:http://www.debian.org/security/2004/dsa-438

External Source: CIAC

Name: O-082

Hyperlink:http://www.ciac.org/ciac/bulletins/o-082.shtml

External Source: TRUSTIX

Name: 2004-0008

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=107755871932680&w=2

External Source: TRUSTIX

Name: 2004-0007

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=107712137732553&w=2

External Source: MANDRAKE

Name: MDKSA-2004:015

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2004:015

External Source: FEDORA

Name: FEDORA-2004-079

Hyperlink:http://fedoranews.org/updates/FEDORA-2004-079.shtml

External Source: CONECTIVA

Name: CLA-2004:820

Hyperlink:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000820

External Source: VULNWATCH

Name: 20040218 Second critical mremap() bug found in all Linux kernels

Hyperlink:http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0040.html

US Government Resource: oval:org.mitre.oval:def:837

Name: oval:org.mitre.oval:def:837

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:837

US Government Resource: oval:org.mitre.oval:def:825

Name: oval:org.mitre.oval:def:825

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:825