#VU95752 Resource management errors in Linux kernel - CVE-2006-4535
Vulnerability identifier: #VU95752
Vulnerability risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID:
CWE-ID:
CWE-399
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
Linux kernel
Operating systems & Components /
Operating system
Vendor: Linux Foundation
Description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The Linux kernel 2.6.17.10 and 2.6.17.11 and 2.6.18-rc5 allows local users to cause a denial of service (crash) via an SCTP socket with a certain SO_LINGER value, possibly related to the patch for CVE-2006-3745. NOTE: older kernel versions for specific Linux distributions are also affected, due to backporting of the CVE-2006-3745 patch.
Mitigation
Install update from vendor's repository.
Vulnerable software versions
Linux kernel: All versions
External links
https://secunia.com/advisories/21945
https://secunia.com/advisories/21967
https://secunia.com/advisories/22082
https://secunia.com/advisories/22093
https://secunia.com/advisories/22292
https://secunia.com/advisories/22382
https://secunia.com/advisories/22945
https://securitytracker.com/id?1016992
https://support.avaya.com/elmodocs2/security/ASA-2006-249.htm
https://www.debian.org/security/2006/dsa-1183
https://www.debian.org/security/2006/dsa-1184
https://www.mail-archive.com/kernel-svn-changes@lists.alioth.debian.org/msg02314.html
https://www.mandriva.com/security/advisories?name=MDKSA-2006:182
https://www.mandriva.com/security/advisories?name=MDKSA-2007:025
https://www.redhat.com/support/errata/RHSA-2006-0689.html
https://www.securityfocus.com/bid/20087
https://www.ubuntu.com/usn/usn-347-1
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=204460
https://exchange.xforce.ibmcloud.com/vulnerabilities/29011
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10530
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
