#VU95767 Security restrictions bypass in Linux kernel - CVE-2005-2555

Vulnerability identifier: #VU95767

Vulnerability risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2005-2555

CWE-ID: CWE-264

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to read and manipulate data.

Linux kernel 2.6.x does not properly restrict socket policy access to users with the CAP_NET_ADMIN capability, which could allow local users to conduct unauthorized activities via (1) ipv4/ip_sockglue.c and (2) ipv6/ipv6_sockglue.c.

Mitigation
Install update from vendor's repository.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://secunia.com/advisories/17002
https://secunia.com/advisories/17073
https://secunia.com/advisories/17826
https://secunia.com/advisories/19369
https://secunia.com/advisories/19374
https://www.debian.org/security/2006/dsa-1017
https://www.debian.org/security/2006/dsa-1018
https://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6fc0b4a7a73a81e74d0004732df358f4f9975be2
https://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=6fc0b4a7a73a81e74d0004732df358f4f9975be2
https://www.mandriva.com/security/advisories?name=MDKSA-2005:218
https://www.mandriva.com/security/advisories?name=MDKSA-2005:219
https://www.novell.com/linux/security/advisories/2005_50_kernel.html
https://www.redhat.com/support/errata/RHSA-2005-514.html
https://www.redhat.com/support/errata/RHSA-2005-663.html
https://www.securityfocus.com/archive/1/427980/100/0/threaded
https://www.securityfocus.com/bid/14609
https://www.vupen.com/english/advisories/2005/1878
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10444
https://usn.ubuntu.com/169-1/

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.