PT-2004-3725 · Debian · Debian

Published 1970-01-01 · Updated 2017-10-11 · CVE-2004-0565

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Debian GNU/Linux kernel-image-2.4.18-powerpc-xfs version Debian GNU/Linux kernel-image-2.4.18-sun4u version Debian GNU/Linux kernel-image-2.4.18-sun4u-smp version Debian GNU/Linux kernel-image-2.4.19-sparc version Debian GNU/Linux kernel-image-2.4.19-sun4u version Debian GNU/Linux kernel-image-2.4.19-sun4u-smp version Debian GNU/Linux kernel-headers-2.4.18-sparc version Debian GNU/Linux kernel-headers-2.4.19-sparc version Debian GNU/Linux kernel-patch-benh version

Description The issue concerns multiple vulnerabilities in the Debian GNU/Linux kernel packages. These vulnerabilities can lead to breaches of confidentiality, integrity, and availability of protected information. Exploitation can be carried out remotely. According to the information from Mitre, there is a floating point information leak in the context switch code for Linux 2.4.x, which only checks the MFH bit but does not verify the FPH owner. This allows local users to read register values of other processes by setting the MFH bit.

Recommendations For kernel-image-2.4.18-powerpc-xfs, consider disabling the vulnerable kernel functions until a patch is available. For kernel-image-2.4.18-sun4u, restrict access to the kernel to minimize the risk of exploitation. For kernel-image-2.4.18-sun4u-smp, avoid using the vulnerable kernel features in the affected kernel version until the issue is resolved. For kernel-image-2.4.19-sparc, kernel-image-2.4.19-sun4u, kernel-image-2.4.19-sun4u-smp, kernel-headers-2.4.18-sparc, kernel-headers-2.4.19-sparc, and kernel-patch-benh, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BDU:2015-03380

BDU:2015-03381

BDU:2015-03382

BDU:2015-03383

BDU:2015-03384

BDU:2015-03385

BDU:2015-03576

BDU:2015-03577

CVE-2004-0565

DSA-1067-1

DSA-1069-1

DSA-1070-1

DSA-1082-1

RHSA-2004:689

Affected Products

Debian

References · 56

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0138 · Security Note
• https://bdu.fstec.ru/vul/2015-03576 · Security Note
• http://archives.neohapsis.com/archives/linux/owl/2004-q2/0038.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0997 · Security Note
• https://bdu.fstec.ru/vul/2015-03384 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1072 · Security Note
• http://debian.org/security/2006/dsa-1069 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1070 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2004:066 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0001 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1234 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1073 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0003 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0565 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0984 · Security Note