Memory corruption in Linux kernel

1) Memory corruption

EUVDB-ID: #VU95658

Risk: Low

CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2003-0985

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a local user to execute arbitrary code.

The mremap system call (do_mremap) in Linux kernel 2.4.x before 2.4.21, and possibly other versions before 2.4.24, does not properly perform bounds checks, which allows local users to cause a denial of service and possibly gain privileges by causing a remapping of a virtual memory area (VMA) to create a 0 length VMA, a different vulnerability than CAN-2004-0077.

Mitigation

Install update from vendor's repository.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

https:ftp://patches.sgi.com/support/free/security/advisories/20040102-01-U
https://archives.neohapsis.com/archives/bugtraq/2004-01/0070.html
https://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000799
https://download.immunix.org/ImmunixOS/7.3/updates/IMNX-2004-73-001-01
https://isec.pl/vulnerabilities/isec-0013-mremap.txt
https://klecker.debian.org/~joey/security/kernel/patches/patch.CAN-2005-0528.mremap
https://marc.info/?l=bugtraq&m=107332754521495&w=2
https://marc.info/?l=bugtraq&m=107332782121916&w=2
https://marc.info/?l=bugtraq&m=107340358402129&w=2
https://marc.info/?l=bugtraq&m=107340814409017&w=2
https://marc.info/?l=bugtraq&m=107350348418373&w=2
https://marc.info/?l=bugtraq&m=107394143105081&w=2
https://secunia.com/advisories/10532
https://secunia.com/advisories/20163
https://secunia.com/advisories/20202
https://secunia.com/advisories/20338
https://svn.debian.org/wsvn/kernel/patch-tracking/CVE-2005-0528?op=file&rev=0&sc=0
https://www.ciac.org/ciac/bulletins/o-045.shtml
https://www.debian.org/security/2004/dsa-413
https://www.debian.org/security/2004/dsa-417
https://www.debian.org/security/2004/dsa-423
https://www.debian.org/security/2004/dsa-427
https://www.debian.org/security/2004/dsa-439
https://www.debian.org/security/2004/dsa-440
https://www.debian.org/security/2004/dsa-442
https://www.debian.org/security/2004/dsa-450
https://www.debian.org/security/2004/dsa-470
https://www.debian.org/security/2004/dsa-475
https://www.debian.org/security/2006/dsa-1067
https://www.debian.org/security/2006/dsa-1069
https://www.debian.org/security/2006/dsa-1070
https://www.debian.org/security/2006/dsa-1082
https://www.kb.cert.org/vuls/id/490620
https://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.24
https://www.linuxsecurity.com/advisories/engarde_advisory-3904.html
https://www.mandrakesoft.com/security/advisories?name=MDKSA-2004:001
https://www.novell.com/linux/security/advisories/2004_03_linux_kernel.html
https://www.osvdb.org/3315
https://www.redhat.com/support/errata/RHSA-2003-416.html
https://www.redhat.com/support/errata/RHSA-2003-417.html
https://www.redhat.com/support/errata/RHSA-2003-418.html
https://www.redhat.com/support/errata/RHSA-2003-419.html
https://www.securityfocus.com/bid/9356
https://exchange.xforce.ibmcloud.com/vulnerabilities/14135
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A860
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A867

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.