Improper input validation in Linux kernel



Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2006-4538
CWE-ID CWE-20
Exploitation vector Local
Public exploit N/A
Vulnerable software
 Linux kernel
Operating systems & Components / Operating system

Vendor Linux Foundation

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Improper input validation

EUVDB-ID: #VU99894

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2006-4538

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

Linux kernel 2.6.17 and earlier, when running on IA64 or SPARC platforms, allows local users to cause a denial of service (crash) via a malformed ELF file that triggers memory maps that cross region boundaries.

Mitigation

Install update from vendor's repository.

Vulnerable software versions

Linux kernel: All versions

CPE2.3 External links

https://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.17.11
https://lkml.org/lkml/2006/9/4/116
https://rhn.redhat.com/errata/RHSA-2007-0014.html
https://secunia.com/advisories/21967
https://secunia.com/advisories/21999
https://secunia.com/advisories/23370
https://secunia.com/advisories/23395
https://secunia.com/advisories/23474
https://secunia.com/advisories/23997
https://secunia.com/advisories/24206
https://secunia.com/advisories/24482
https://secunia.com/advisories/27913
https://secunia.com/advisories/33280
https://support.avaya.com/elmodocs2/security/ASA-2007-063.htm
https://www.kernel.org/git/?p=linux/kernel/git/stable/linux-2.6.17.y.git;a=commit;h=8833ebaa3f4325820fe3338ccf6fae04f6669254
https://www.mandriva.com/security/advisories?name=MDKSA-2007:060
https://www.novell.com/linux/security/advisories/2006_79_kernel.html
https://www.redhat.com/support/errata/RHSA-2007-1049.html
https://www.redhat.com/support/errata/RHSA-2008-0787.html
https://www.securityfocus.com/bid/19702
https://www.ubuntu.com/usn/usn-347-1
https://www.us.debian.org/security/2006/dsa-1233
https://www.us.debian.org/security/2006/dsa-1237
https://www.vupen.com/english/advisories/2006/3670
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10301


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###