Security restrictions bypass in Linux kernel

1) Security restrictions bypass

EUVDB-ID: #VU95243

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C]

CVE-ID: CVE-2005-3257

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: Yes

Description

The vulnerability allows a local user to read and manipulate data.

The VT implementation (vt_ioctl.c) in Linux kernel 2.6.12, and possibly other versions including 2.6.14.4, allows local users to use the KDSKBSENT ioctl on terminals of other users and gain privileges, as demonstrated by modifying key bindings using loadkeys.

Mitigation

Install update from vendor's repository.

Vulnerable software versions

Linux kernel: All versions

External links

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=334113
http://rhn.redhat.com/errata/RHBA-2007-0304.html
http://secunia.com/advisories/17226
http://secunia.com/advisories/17826
http://secunia.com/advisories/17995
http://secunia.com/advisories/18203
http://secunia.com/advisories/19185
http://secunia.com/advisories/19369
http://secunia.com/advisories/19374
http://www.debian.org/security/2006/dsa-1017
http://www.debian.org/security/2006/dsa-1018
http://www.mandriva.com/security/advisories?name=MDKSA-2005:218
http://www.mandriva.com/security/advisories?name=MDKSA-2005:219
http://www.mandriva.com/security/advisories?name=MDKSA-2005:220
http://www.mandriva.com/security/advisories?name=MDKSA-2005:235
http://www.securityfocus.com/bid/15122
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10615
http://usn.ubuntu.com/231-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.