Linux Kernel Multiple Local Buffer Overflow And Memory Disclosure Vulnerabilities

BID:12555

Info

Linux Kernel Multiple Local Buffer Overflow And Memory Disclosure Vulnerabilities

Bugtraq ID: 12555
Class: Boundary Condition Error
CVE: CVE-2005-0529
CVE-2005-0530
CVE-2005-0531
CVE-2005-0532
CVE-2005-0767
Remote: No
Local: Yes
Published: Feb 15 2005 12:00AM
Updated: Jul 12 2009 10:06AM
Credit: <airlied@starflyer.(none)>, Jean Delvare, and Georgi Guninski are credited with the discovery of these issues.
Vulnerable: Redhat Fedora Core3
Redhat Fedora Core2
Redhat Enterprise Linux WS 4
Redhat Enterprise Linux ES 4
Redhat Enterprise Linux AS 4
Redhat Desktop 4.0
Mandriva Linux Mandrake 10.1 x86_64
Mandriva Linux Mandrake 10.1
Mandriva Linux Mandrake 10.0 AMD64
Mandriva Linux Mandrake 10.0
MandrakeSoft Multi Network Firewall 2.0
MandrakeSoft Corporate Server 3.0 x86_64
MandrakeSoft Corporate Server 3.0
MandrakeSoft Corporate Server 2.1 x86_64
MandrakeSoft Corporate Server 2.1
Linux kernel 2.6.11 -rc3
Linux kernel 2.6.11 -rc2
Linux kernel 2.6.10 rc2
Linux kernel 2.6.10
+ Redhat Fedora Core3
 + Redhat Fedora Core2
 + Trustix Secure Linux 3.0
+ Ubuntu Ubuntu Linux 5.0 4 powerpc
 + Ubuntu Ubuntu Linux 5.0 4 i386
 + Ubuntu Ubuntu Linux 5.0 4 amd64
 Linux kernel 2.6.9
Linux kernel 2.6.8 rc3
Linux kernel 2.6.8 rc2
Linux kernel 2.6.8 rc1
+ Ubuntu Ubuntu Linux 4.1 ppc
 + Ubuntu Ubuntu Linux 4.1 ia64
 + Ubuntu Ubuntu Linux 4.1 ia32
 Linux kernel 2.6.8
+ S.u.S.E. Linux Personal 9.2 x86_64
 + S.u.S.E. Linux Personal 9.2
+ Ubuntu Ubuntu Linux 4.1 ppc
 + Ubuntu Ubuntu Linux 4.1 ia64
 + Ubuntu Ubuntu Linux 4.1 ia32
 Linux kernel 2.6.7 rc1
Linux kernel 2.6.7
Linux kernel 2.6.6 rc1
Linux kernel 2.6.6
Linux kernel 2.6.5
+ S.u.S.E. Linux Personal 9.1 x86_64
 + S.u.S.E. Linux Personal 9.1 x86_64
 + S.u.S.E. Linux Personal 9.1
+ S.u.S.E. Linux Personal 9.1
+ SuSE Linux Enterprise Server 9
 Linux kernel 2.6.4
Linux kernel 2.6.3
Linux kernel 2.6.2
Linux kernel 2.6.1 -rc2
Linux kernel 2.6.1 -rc1
Linux kernel 2.6.1
Linux kernel 2.6 .10
Linux kernel 2.6
ALT Linux ALT Linux Junior 2.3
ALT Linux ALT Linux Compact 2.3
Not Vulnerable: Linux kernel 2.6.11 -rc4

Discussion

Linux Kernel Multiple Local Buffer Overflow And Memory Disclosure Vulnerabilities

Multiple local buffer overflow and memory disclosure vulnerabilities affect the Linux kernel. These issues are due to a failure to securely copy user-controlled data, a race condition error, and a failure to secure memory written by the kernel.

The first issue is a buffer overflow vulnerability in the procfs functionality. The second issue is a kernel memory disclosure vulnerability. The third issue is a race condition error in the Radeon driver that leads to a potential buffer overflow condition. The fourth issue is a buffer overflow vulnerability in the i2c-viapro driver.

A local attacker may leverage these issues to execute arbitrary code, potentially facilitating privilege escalation, and to disclose sensitive kernel memory.

Exploit / POC

Linux Kernel Multiple Local Buffer Overflow And Memory Disclosure Vulnerabilities

Exploits have been released for the procfs buffer overflow and the kernel memory disclosure issues. These exploits can be viewed at the following location:

http://www.guninski.com/where_do_you_want_billg_to_go_today_3.html

Solution / Fix

Linux Kernel Multiple Local Buffer Overflow And Memory Disclosure Vulnerabilities

Solution:
The vendor has released fixes dealing with these issues.

Conectiva has released a security advisory (CLA-2005:945) and fixes to address these and other issues. Please see the referenced advisory for further information regarding obtaining and applying appropriate updates.

ALT Linux has released updates dealing with this and other issues. Please see the reference section for more information.

RedHat has released an advisory (FEDORA-2005-262) and fixes for Fedora Core 2. Please see the referenced advisory for further information.

Conectiva has released a security advisory (CLA-2005:930) and fixes to address these and other issues. Please see the referenced advisory for further information regarding obtaining and applying appropriate updates.

SuSE has released summary report SUSE-SR:2005:006 mainly to address vulnerabilities described in other BIDs. However, in the addendum of this advisory, it is reported that fixes for the issues described in this BID are pending release. Customers are advised to see the referenced advisory for further information.

Ubuntu has released advisory USN-95-1 to address these issues. Please see the referenced advisory for more information.

SuSE Linux has released advisory SUSE-SA:2005:018 along with fixes dealing with this and other issues. Please see the referenced advisory for more information.

RedHat has released advisory FEDORA-2005-313 to address this issue for Fedora Core 3. Please see the referenced advisory for further information.

RedHat has released advisory RHSA-2005:366-19 to address this, and other issues in RedHat Enterprise Linux 4, and RedHat Desktop 4 operating systems. Please see the referenced advisory for further information.

Mandriva Linux has released advisories MDKSA-2005:110 and MDKSA-2005:111 addressing this issue. Please see the referenced advisory for further information.


Linux kernel 2.6.10 rc2

Linux kernel 2.6.10

Linux kernel 2.6.11 -rc3

Linux kernel 2.6.11 -rc2

Linux kernel 2.6.4

Linux kernel 2.6.5

Linux kernel 2.6.8 rc1

Linux kernel 2.6.8

Linux kernel 2.6.9

References

© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report