National Cyber Awareness System

Vulnerability Summary for CVE-2008-2137

Overview

The (1) sparc_mmap_check function in arch/sparc/kernel/sys_sparc.c and the (2) sparc64_mmap_check function in arch/sparc64/kernel/sys_sparc.c, in the Linux kernel 2.4 before 2.4.36.5 and 2.6 before 2.6.25.3, omit some virtual-address range (aka span) checks when the mmap MAP_FIXED bit is not set, which allows local users to cause a denial of service (panic) via unspecified mmap calls.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statements (disclaimer)

Official Statement from Red Hat (07/02/2008)

Not vulnerable. Red Hat Enterprise Linux 2.1, 3, 4, and 5 do not ship for the SPARC architecture.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: linux-kernel-mmap-dos(42681)

Hyperlink:http://xforce.iss.net/xforce/xfdb/42681

External Source: VUPEN

Name: ADV-2008-1716

Hyperlink:http://www.vupen.com/english/advisories/2008/1716/references

External Source: UBUNTU

Name: USN-625-1

Hyperlink:http://www.ubuntu.com/usn/usn-625-1

External Source: SECTRACK

Name: 1020119

Hyperlink:http://www.securitytracker.com/id?1020119

External Source: BID

Name: 29397

Hyperlink:http://www.securityfocus.com/bid/29397

External Source: CONFIRM

Name: http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.3

Hyperlink:http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.3

External Source: CONFIRM

Name: http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.36.5

Hyperlink:http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.36.5

External Source: DEBIAN

Name: DSA-1588

Hyperlink:http://www.debian.org/security/2008/dsa-1588

External Source: SECUNIA

Name: 31107

Hyperlink:http://secunia.com/advisories/31107

External Source: SECUNIA

Name: 30499

Hyperlink:http://secunia.com/advisories/30499

External Source: SECUNIA

Name: 30368

Type: Advisory

Hyperlink:http://secunia.com/advisories/30368

External Source: MLIST

Name: [git-commits-head] 20080507 sparc: Fix mmap VA span checking.

Hyperlink:http://kerneltrap.org/mailarchive/git-commits-head/2008/5/8/1760604