Vulnerability Note VU#698640

Linux kernel does not properly validate user input via sysctl for negative value

Original Release date: 18 Jul 2001 | Last revised: 24 Jul 2001

Overview

Unprivileged local users can exploit the sysctl Linux kernel program to gain privileged access.

Description

A program called sysctl in the Linux kernel allows a privileged local user to read or write runtime system settings. Unprivileged local users are also allowed to use sysctl to read many of these settings. The program takes as parameters a buffer location and length. The length parameter is declared as signed and, therefore, allows passing of negative values. According to Chris Evans, the discoverer of this vulnerability, "by specifying a negative buffer length, a user can read pretty arbitrary memory." This flaw allows attackers to read privileged Linux kernel memory and, ultimately, gain root access. Linux kernel version 2.2.18 or before are vulnerable to this flaw. Any Linux product that is dependent on this kernel is, therefore, vulnerable.

Impact

Unprivileged local users can read privileged kernel space addresses and, potentially, gain privileged (root) access.

Solution

Upgrade the Linux kernel to version 2.2.19 or later. The release notes for Linux 2.2.19 at http://www.linux.org.uk/VERSION/relnotes.2219.html describe the security fix. For users of specific Linux vendors, use the vendor-specific upgrades for convenience and consistency.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
CalderaAffected08 Feb 200126 Jun 2001
ConectivaAffected19 Apr 200126 Jun 2001
DebianAffected16 Apr 200126 Jun 2001
ImmunixAffected08 Feb 200126 Jun 2001
MandrakeSoftAffected17 Apr 200126 Jun 2001
RedHatAffected08 Feb 200126 Jun 2001
SuSEAffected17 May 200126 Jun 2001
TrustixAffected13 Feb 200126 Jun 2001
SlackwareUnknown-18 Jul 2001
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Thanks to Chris Evans for discovering this vulnerability.

This document was written by Andrew P. Moore.

Other Information

  • CVE IDs: CVE-2001-0316
  • Date Public: 08 Feb 2001
  • Date First Published: 18 Jul 2001
  • Date Last Updated: 24 Jul 2001
  • Severity Metric: 9.22
  • Document Revision: 22

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.