PT-2004-3722 · Linux · Aa-Sources+7

Paul Starzetz + 1 · Published 1970-01-01 · Updated 2024-01-26 · CVE-2004-0427

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.4.26 Linux kernel versions prior to 2.6.6 aa-sources versions prior to 2.4.23-r2 kernel-image-2.4.18-powerpc-xfs version kernel-image-2.4.18-sun4u version kernel-image-2.4.18-sun4u-smp version kernel-image-2.4.19-sparc version kernel-image-2.4.19-sun4u version kernel-image-2.4.19-sun4u-smp version kernel-headers-2.4.18-sparc version kernel-headers-2.4.19-sparc version

Description The issue is related to multiple vulnerabilities in the Linux kernel, which can lead to a disruption of confidentiality, integrity, and availability of protected information. Exploitation of these vulnerabilities can be done remotely or locally, depending on the specific vulnerability. The do fork function in Linux 2.4.x and 2.6.x does not properly decrement the mm count counter when an error occurs after the mm struct for a child process has been activated, triggering a memory leak that allows local users to cause a denial of service via the clone system call.

Recommendations For Linux kernel versions prior to 2.4.26, update to version 2.4.26 or later. For Linux kernel versions prior to 2.6.6, update to version 2.6.6 or later. For aa-sources versions prior to 2.4.23-r2, update to version 2.4.23-r2 or later. For kernel-image-2.4.18-powerpc-xfs, kernel-image-2.4.18-sun4u, kernel-image-2.4.18-sun4u-smp, kernel-image-2.4.19-sparc, kernel-image-2.4.19-sun4u, kernel-image-2.4.19-sun4u-smp, kernel-headers-2.4.18-sparc, and kernel-headers-2.4.19-sparc, update to a non-vulnerable version. As a temporary workaround, consider restricting access to the clone system call to minimize the risk of exploitation.

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2015-03380

BDU:2015-03381

BDU:2015-03382

BDU:2015-03383

BDU:2015-03384

BDU:2015-03385

BDU:2015-03576

BDU:2015-03577

BDU:2015-09455

CVE-2004-0427

DSA-1067-1

DSA-1069-1

DSA-1070-1

DSA-1082-1

RHSA-2004:255

Affected Products

Linux Kernel

Aa-Sources

Kernel-Headers-2.4.18-Sparc

Kernel-Headers-2.4.19-Sparc

Kernel-Image-2.4.18-Powerpc-Xfs

Kernel-Image-2.4.18-Sun4U

Kernel-Image-2.4.19-Sparc

Kernel-Image-2.4.19-Sun4U

References · 77

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0138 · Security Note
• http://security.gentoo.org/glsa/glsa-200407-02.xml · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03576 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0997 · Security Note
• https://bdu.fstec.ru/vul/2015-03384 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1072 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2004:037 · Vendor Advisory
• http://debian.org/security/2006/dsa-1069 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1070 · Security Note
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000846 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0001 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1234 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1073 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0003 · Security Note
• http://redhat.com/support/errata/RHSA-2004-260.html · Vendor Advisory