|
|
|
 |
Vulnerability Note VU#698640Linux kernel does not properly validate user input via sysctl for negative valueOverviewUnprivileged local users can exploit the sysctl Linux kernel program to gain privileged access.I. DescriptionA program called sysctl in the Linux kernel allows a privileged local user to read or write runtime system settings. Unprivileged local users are also allowed to use sysctl to read many of these settings. The program takes as parameters a buffer location and length. The length parameter is declared as signed and, therefore, allows passing of negative values. According to Chris Evans, the discoverer of this vulnerability, "by specifying a negative buffer length, a user can read pretty arbitrary memory." This flaw allows attackers to read privileged Linux kernel memory and, ultimately, gain root access. Linux kernel version 2.2.18 or before are vulnerable to this flaw. Any Linux product that is dependent on this kernel is, therefore, vulnerable.II. ImpactUnprivileged local users can read privileged kernel space addresses and, potentially, gain privileged (root) access.III. SolutionUpgrade the Linux kernel to version 2.2.19 or later. The release notes for Linux 2.2.19 at http://www.linux.org.uk/VERSION/relnotes.2219.html describe the security fix. For users of specific Linux vendors, use the vendor-specific upgrades for convenience and consistency.Systems Affected
Referenceshttps://www.kb.cert.org/vuls/id/176888 Thanks to Chris Evans for discovering this vulnerability. This document was written by Andrew P. Moore.
If you have feedback, comments, or additional information about this vulnerability, please send us
email. |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||