PT-2005-3593 · Linux+1 · Linux Kernel+1

Blossom · Published 2005-10-25 · Updated 2018-10-19 · CVE-2005-2708

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Linux kernel version 2.4 on 64-bit x86 architectures

Description The issue is related to the search binary handler function in exec.c, which does not properly check a return code when virtual memory is low. This can be exploited by local users to cause a denial of service, resulting in a system panic. The exploitation can be demonstrated by running a process with limited virtual memory using the bash ulimit -v command.

Recommendations For Linux kernel version 2.4 on 64-bit x86 architectures, consider applying a patch that fixes the search binary handler function to properly handle return codes when virtual memory is low. As a temporary workaround, restrict the use of the bash ulimit -v command to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2005-2708

RHSA-2006:0140

Affected Products

Linux Kernel

Bash

References · 11

• 🔥 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=161925 · Exploit
• http://secunia.com/advisories/18523 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2006-0190.html · Vendor Advisory
• http://securityfocus.com/archive/1/428058/100/0/threaded · Vendor Advisory
• http://securityfocus.com/archive/1/428028/100/0/threaded · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2006-0140.html · Vendor Advisory
• http://secunia.com/advisories/18684 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2708 · Security Note
• http://secunia.com/advisories/18562 · Vendor Advisory
• http://securityfocus.com/bid/16320 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10649 · Note