PT-2008-3651 · Linux · Linux Kernel

David Miller + 1 · Published 2008-05-29 · Updated 2018-10-30 · CVE-2008-2137

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.4.36.5 Linux kernel versions prior to 2.6.25.3

Description The issue concerns the sparc mmap check function in arch/sparc/kernel/sys sparc.c and the sparc64 mmap check function in arch/sparc64/kernel/sys sparc.c. These functions omit some virtual-address range checks when the mmap MAP FIXED bit is not set. This allows local users to cause a denial of service, resulting in a system panic, via unspecified mmap calls.

Recommendations For Linux kernel versions prior to 2.4.36.5, update to version 2.4.36.5 or later to resolve the issue. For Linux kernel versions prior to 2.6.25.3, update to version 2.6.25.3 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-2137

DSA-1588-1

Affected Products

Linux Kernel

References · 13

• 🔥 http://kerneltrap.org/mailarchive/git-commits-head/2008/5/8/1760604 · Exploit
• http://secunia.com/advisories/30368 · Vendor Advisory
• http://ubuntu.com/usn/usn-625-1 · Vendor Advisory
• http://debian.org/security/2008/dsa-1588 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2137 · Security Note
• http://secunia.com/advisories/31107 · Note
• http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.3 · Note
• http://securityfocus.com/bid/29397 · Note
• http://secunia.com/advisories/30499 · Note
• http://vupen.com/english/advisories/2008/1716/references · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42681 · Note
• http://securitytracker.com/id?1020119 · Note
• http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.36.5 · Note