PT-2004-3760 · Linux+2 · Linux Kernel+2
Published
1970-01-01
·
Updated
2017-10-11
·
CVE-2007-1353
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Debian GNU/Linux kernel-image-2.4.27-4 versions
Debian GNU/Linux kernel-pcmcia-modules-2.4.27-4 versions
Debian GNU/Linux kernel-headers-2.4.27-4 versions
Debian GNU/Linux hostap-modules-2.4.27-4 versions
Debian GNU/Linux i2c-2.4.27-4 versions
Debian GNU/Linux lm-sensors-2.4.27-4 versions
Debian GNU/Linux pcmcia-modules-2.4.27-4 versions
Description
The issue involves multiple vulnerabilities in various packages of the Debian GNU/Linux operating system, including kernel-image, kernel-pcmcia-modules, kernel-headers, hostap-modules, i2c, lm-sensors, and pcmcia-modules. These vulnerabilities can lead to a disruption of protected information and can be exploited remotely. According to the information from Mitre, the setsockopt function in the L2CAP and HCI Bluetooth support in the Linux kernel before 2.4.34.3 allows context-dependent attackers to read kernel memory and obtain sensitive information via unspecified vectors involving the copy from user function accessing an uninitialized stack buffer.
Recommendations
As a temporary workaround, consider disabling the
setsockopt function until a patch is available.
Restrict access to the vulnerable kernel modules to minimize the risk of exploitation.
Avoid using the copy from user function in the affected kernel versions until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability. Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Debian
Linux Kernel
Red Hat