Vulnerability Note VU#698640
Linux kernel does not properly validate user input via sysctl for negative value
Unprivileged local users can exploit the sysctl Linux kernel program to gain privileged access.
A program called sysctl in the Linux kernel allows a privileged local user to read or write runtime system settings. Unprivileged local users are also allowed to use sysctl to read many of these settings. The program takes as parameters a buffer location and length. The length parameter is declared as signed and, therefore, allows passing of negative values. According to Chris Evans, the discoverer of this vulnerability, "by specifying a negative buffer length, a user can read pretty arbitrary memory." This flaw allows attackers to read privileged Linux kernel memory and, ultimately, gain root access. Linux kernel version 2.2.18 or before are vulnerable to this flaw. Any Linux product that is dependent on this kernel is, therefore, vulnerable.
Unprivileged local users can read privileged kernel space addresses and, potentially, gain privileged (root) access.
Upgrade the Linux kernel to version 2.2.19 or later. The release notes for Linux 2.2.19 at http://www.linux.org.uk/VERSION/relnotes.2219.html describe the security fix. For users of specific Linux vendors, use the vendor-specific upgrades for convenience and consistency.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Caldera||Affected||08 Feb 2001||26 Jun 2001|
|Conectiva||Affected||19 Apr 2001||26 Jun 2001|
|Debian||Affected||16 Apr 2001||26 Jun 2001|
|Immunix||Affected||08 Feb 2001||26 Jun 2001|
|MandrakeSoft||Affected||17 Apr 2001||26 Jun 2001|
|RedHat||Affected||08 Feb 2001||26 Jun 2001|
|SuSE||Affected||17 May 2001||26 Jun 2001|
|Trustix||Affected||13 Feb 2001||26 Jun 2001|
|Slackware||Unknown||-||18 Jul 2001|
CVSS Metrics (Learn More)
Thanks to Chris Evans for discovering this vulnerability.
This document was written by Andrew P. Moore.
- CVE IDs: CVE-2001-0316
- Date Public: 08 Feb 2001
- Date First Published: 18 Jul 2001
- Date Last Updated: 24 Jul 2001
- Severity Metric: 9.22
- Document Revision: 22
If you have feedback, comments, or additional information about this vulnerability, please send us email.