Information exposure in Linux kernel

1) Information exposure

EUVDB-ID: #VU99946

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2004-0177

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The ext3 code in Linux 2.4.x before 2.4.26 does not properly initialize journal descriptor blocks, which causes an information leak in which in-memory data is written to the device for the ext3 file system, which allows privileged users to obtain portions of kernel memory by reading the raw device.

Mitigation

Install update from vendor's repository.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

https://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000846
https://linux.bkbits.net:8080/linux-2.4/cset@4056b368s6vpJbGWxDD_LhQNYQrdzQ
https://marc.info/?l=bugtraq&m=108213675028441&w=2
https://rhn.redhat.com/errata/RHSA-2004-166.html
https://security.gentoo.org/glsa/glsa-200407-02.xml
https://www.ciac.org/ciac/bulletins/o-121.shtml
https://www.ciac.org/ciac/bulletins/o-126.shtml
https://www.ciac.org/ciac/bulletins/o-127.shtml
https://www.debian.org/security/2004/dsa-479
https://www.debian.org/security/2004/dsa-480
https://www.debian.org/security/2004/dsa-481
https://www.debian.org/security/2004/dsa-482
https://www.debian.org/security/2004/dsa-489
https://www.debian.org/security/2004/dsa-491
https://www.debian.org/security/2004/dsa-495
https://www.linuxsecurity.com/advisories/engarde_advisory-4285.html
https://www.mandriva.com/security/advisories?name=MDKSA-2004:029
https://www.redhat.com/support/errata/RHSA-2004-504.html
https://www.redhat.com/support/errata/RHSA-2004-505.html
https://www.redhat.com/support/errata/RHSA-2005-293.html
https://www.securityfocus.com/bid/10152
https://bugzilla.fedora.us/show_bug.cgi?id=2336
https://exchange.xforce.ibmcloud.com/vulnerabilities/15867
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10556

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.