SB2005051701 - Improper input validation in Linux kernel
Published: May 17, 2005
Security Bulletin ID
SB2005051701
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Improper input validation (CVE-ID: CVE-2005-1264)
The vulnerability allows a local user to execute arbitrary code.
Raw character devices (raw.c) in the Linux kernel 2.6.x call the wrong function before passing an ioctl to the block device, which crosses security boundaries by making kernel address space accessible from user space, a similar vulnerability to CVE-2005-1589.
Remediation
Install update from vendor's website.
References
- http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0045.html
- http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0046.html
- http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.11.10
- http://marc.info/?l=linux-kernel&m=111630512512222
- http://www.redhat.com/support/errata/RHSA-2005-420.html
- http://www.securityfocus.com/archive/1/427980/100/0/threaded
- http://www.securityfocus.com/bid/13651
- http://www.vupen.com/english/advisories/2005/0557
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10264