PT-2008-6967 · Opensuse+1 · Opensuse+1
Eugene Teo
·
Published
1970-01-01
·
Updated
2017-08-08
·
CVE-2008-3911
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
openSUSE kernel-rt debug (affected versions not specified)
openSUSE kernel-rt (affected versions not specified)
Linux kernel version 2.6.26.3
Description
The issue involves multiple vulnerabilities in the kernel-rt and kernel-rt debug packages of the openSUSE operating system, which can be exploited remotely to compromise the availability of protected information. A specific vulnerability in the Linux kernel 2.6.26.3 is related to the proc do xprt function in net/sunrpc/sysctl.c, where it fails to check the length of a certain buffer obtained from userspace. This allows local users to overflow a stack-based buffer via a crafted read system call for the /proc/sys/sunrpc/transports file.
Recommendations
For openSUSE kernel-rt debug, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
For openSUSE kernel-rt, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
For Linux kernel version 2.6.26.3, consider restricting access to the
proc do xprt function in net/sunrpc/sysctl.c as a temporary workaround until a patch is available. Avoid using the /proc/sys/sunrpc/transports file in the affected API endpoint until the issue is resolved.Exploit
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux Kernel
Opensuse