PT-2007-3100 · Linux · Linux Kernel

Published 2007-03-28 · Updated 2018-10-16 · CVE-2007-1734

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Linux kernel versions 2.6.20 and later

Description: The issue is related to the DCCP support in the Linux kernel, specifically in the do dccp getsockopt function. It does not properly verify the upper bounds of the optlen value, which can be exploited by local users on certain architectures to read kernel memory or cause a denial of service.

Recommendations: For Linux kernel versions 2.6.20 and later, consider restricting access to the do dccp getsockopt function until a patch is available. As a temporary workaround, avoid using the optlen variable in the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2007-1734

Affected Products

Linux Kernel

References · 8

• 🔥 https://exploit-db.com/exploits/3595 · Exploit
• 🔥 https://exploit-db.com/exploits/3587 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1734 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43321 · Note
• http://securityreason.com/securityalert/2511 · Note
• http://securitytracker.com/id?1017820 · Note
• http://securityfocus.com/archive/1/463969/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33274 · Note