PT-2005-1268 · Linux+1 · Linux+1

Published 2005-02-06 · Updated 2017-10-11 · CVE-2005-0180

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Linux versions 2.6.x

Description The issue concerns multiple integer signedness errors in the sg scsi ioctl function. This allows local users to bypass a maximum length check, potentially enabling them to read or modify kernel memory by providing negative integers as arguments to the scsi ioctl. The errors occur before the copy from user and copy to user functions are called.

Recommendations For Linux version 2.6.x, consider restricting access to the sg scsi ioctl function until a patch is available. As a temporary workaround, avoid using negative integers in arguments to the scsi ioctl to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-0180

RHSA-2005:092

RHSA-2005_092

Affected Products

Linux

Red Hat

References · 33

• 🔥 http://redhat.com/support/errata/RHSA-2005-092.html · Exploit
• https://bdu.fstec.ru/vul/2015-03380 · Security Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2005-January/030660.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03576 · Security Note
• https://bdu.fstec.ru/vul/2015-03384 · Security Note
• https://bdu.fstec.ru/vul/2015-03382 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2005:218 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0180 · Security Note
• http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000930 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03385 · Security Note
• https://bdu.fstec.ru/vul/2015-03577 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2005:219 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03383 · Security Note
• https://bdu.fstec.ru/vul/2015-03381 · Security Note
• https://redhat.com/security/data/cve/CVE-2005-0090.html · Note