Vulnerability Note VU#490620

Linux kernel do_mremap() call creates virtual memory area of 0 bytes in length

Overview

There is a vulnerability in the Linux kernel memory management routines that allows local users to gain superuser privileges.

I. Description

The Linux kernel contains a vulnerability in the do_mremap() call that allows software to create a virtual memory area (VMA) with a length of 0 bytes. This vulnerability is reported to exist in versions 2.4.23 and earlier, excluding 2.2.x versions. Because the vulnerability is located within the kernel, multiple Linux distributions will be affected. An attacker with local access to an affected host may be able to exploit this vulnerability and gain superuser privileges.

II. Impact

This vulnerability allows local users to gain superuser privileges on affected hosts.

III. Solution

Apply a patch from your vendor

This vulnerability affects multiple Linux distributions; please see the Systems Affected section of this document for information on specific vendors.

Systems Affected

Vendor	Status	Date Notified
Conectiva	Vulnerable	19-Aug-2004
Debian	Vulnerable	19-Aug-2004
Guardian Digital Inc.	Vulnerable	19-Aug-2004
Hewlett-Packard Company	Unknown	19-Aug-2004
IBM eServer	Unknown	19-Aug-2004
Ingrian Networks	Unknown	19-Aug-2004
MandrakeSoft	Vulnerable	19-Aug-2004
MontaVista Software	Unknown	19-Aug-2004
Novell	Unknown	19-Aug-2004
Openwall GNU/*/Linux	Unknown	19-Aug-2004
Red Hat Inc.	Vulnerable	19-Aug-2004
Sequent	Unknown	19-Aug-2004
SGI	Vulnerable	16-Mar-2004
Slackware	Vulnerable	16-Mar-2004
Sun Microsystems Inc.	Unknown	19-Aug-2004
SuSE Inc.	Vulnerable	19-Aug-2004
Trustix Secure Linux	Vulnerable	9-Mar-2004
TurboLinux	Vulnerable	9-Mar-2004
VMware	Vulnerable	16-Mar-2004
Wirex	Unknown	19-Aug-2004

References

http://www.kernel.org/
http://isec.pl/vulnerabilities/isec-0013-mremap.txt
http://xforce.iss.net/xforce/xfdb/14135
http://www.ciac.org/ciac/bulletins/o-045.shtml
http://www.secunia.com/advisories/10582/
http://www.secunia.com/advisories/10585/
http://www.secunia.com/advisories/10584/
http://www.secunia.com/advisories/10583/

Credit

This vulnerability was discovered by Paul Starzetz.

This document was written by Jeffrey P. Lanza.

Other Information

Date Public:	2004-01-05
Date First Published:	2004-03-09
Date Last Updated:	2004-08-19
CERT Advisory:
CVE-ID(s):	CAN-2003-0985
NVD-ID(s):	CAN-2003-0985
US-CERT Technical Alerts:
Metric:	13.54
Document Revision:	23

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader