Multiple Linux Kernel IOCTL Handlers Local Memory Corruption Vulnerabilities

BID:13651

Info

Multiple Linux Kernel IOCTL Handlers Local Memory Corruption Vulnerabilities

Bugtraq ID: 13651
Class: Design Error
CVE: CVE-2005-1589
CVE-2005-1264
Remote: No
Local: Yes
Published: May 17 2005 12:00AM
Updated: Jul 12 2009 02:56PM
Credit: alert7 <[email protected]> is credited with the discovery of this issue.
Vulnerable: Ubuntu Ubuntu Linux 5.0 4 powerpc
Ubuntu Ubuntu Linux 5.0 4 i386
Ubuntu Ubuntu Linux 5.0 4 amd64
Ubuntu Ubuntu Linux 4.1 ppc
Ubuntu Ubuntu Linux 4.1 ia64
Ubuntu Ubuntu Linux 4.1 ia32
Redhat Fedora Core3
Redhat Enterprise Linux WS 4
Redhat Enterprise Linux ES 4
Redhat Enterprise Linux AS 4
Redhat Desktop 4.0
Mandriva Linux Mandrake 10.2 x86_64
Mandriva Linux Mandrake 10.2
Mandriva Linux Mandrake 10.1 x86_64
Mandriva Linux Mandrake 10.1
Linux kernel 2.6.12 -rc4
Linux kernel 2.6.11 .8
Linux kernel 2.6.11 .7
Linux kernel 2.6.11 .6
Linux kernel 2.6.11 .5
Linux kernel 2.6.11 -rc4
Linux kernel 2.6.11 -rc3
Linux kernel 2.6.11 -rc2
Linux kernel 2.6.11
+ Redhat Fedora Core4
 Linux kernel 2.6.10 rc2
Linux kernel 2.6.10
+ Redhat Fedora Core3
 + Redhat Fedora Core2
 + Trustix Secure Linux 3.0
+ Ubuntu Ubuntu Linux 5.0 4 powerpc
 + Ubuntu Ubuntu Linux 5.0 4 i386
 + Ubuntu Ubuntu Linux 5.0 4 amd64
 Linux kernel 2.6.9
Linux kernel 2.6.8 rc3
Linux kernel 2.6.8 rc2
Linux kernel 2.6.8 rc1
+ Ubuntu Ubuntu Linux 4.1 ppc
 + Ubuntu Ubuntu Linux 4.1 ia64
 + Ubuntu Ubuntu Linux 4.1 ia32
 Linux kernel 2.6.8
+ S.u.S.E. Linux Personal 9.2 x86_64
 + S.u.S.E. Linux Personal 9.2
+ Ubuntu Ubuntu Linux 4.1 ppc
 + Ubuntu Ubuntu Linux 4.1 ia64
 + Ubuntu Ubuntu Linux 4.1 ia32
 Linux kernel 2.6.7 rc1
Linux kernel 2.6.7
Linux kernel 2.6.6 rc1
Linux kernel 2.6.6
Linux kernel 2.6.5
+ S.u.S.E. Linux Personal 9.1 x86_64
 + S.u.S.E. Linux Personal 9.1 x86_64
 + S.u.S.E. Linux Personal 9.1
+ S.u.S.E. Linux Personal 9.1
+ SuSE Linux Enterprise Server 9
 Linux kernel 2.6.4
Linux kernel 2.6.3
Linux kernel 2.6.2
Linux kernel 2.6.1 -rc2
Linux kernel 2.6.1 -rc1
Linux kernel 2.6.1
Linux kernel 2.6 .10
Linux kernel 2.6 -test9-CVS
Linux kernel 2.6 -test9
Linux kernel 2.6 -test8
Linux kernel 2.6 -test7
Linux kernel 2.6 -test6
Linux kernel 2.6 -test5
Linux kernel 2.6 -test4
Linux kernel 2.6 -test3
Linux kernel 2.6 -test2
Linux kernel 2.6 -test11
Linux kernel 2.6 -test10
Linux kernel 2.6 -test1
Linux kernel 2.6
Not Vulnerable:

Discussion

Multiple Linux Kernel IOCTL Handlers Local Memory Corruption Vulnerabilities

The Linux kernel raw device and pktcdvd block device ioctl handlers are reported prone to local kernel-based memory corruption vulnerabilities. The issues manifest due to a lack of sanity checks performed on argument values that are passed to the 'raw_ioctl()' and 'pkt_ioctl()' functions.

A local attacker, that has read access to a sufficient block device, may leverage this memory corruption to execute arbitrary attacker-supplied code in the context of the system kernel (ring-0).

Exploit / POC

Multiple Linux Kernel IOCTL Handlers Local Memory Corruption Vulnerabilities

The following denial of service proof of concept is available:

Solution / Fix

Multiple Linux Kernel IOCTL Handlers Local Memory Corruption Vulnerabilities

Solution:
Red Hat has released advisory RHSA-2005:420-22 and fixes to address this issue and another issue on Red Hat Linux Enterprise platforms. Customers that are affected by this issue are advised to apply the appropriate updates. Customers subscribed to the Red Hat Network may apply the appropriate fixes using the Red Hat Update Agent (up2date). Please see referenced advisory for additional information.

Ubuntu Linux has released advisory USN-131-1 to address this, and other issues. Please see the referenced advisory for further information.

RedHat Fedora Linux has released advisory FEDORA-2005-392 addressing this issue for Fedora Core 3. Please see the referenced advisory for details on obtaining and applying the appropriate updates.

Mandriva Linux has released advisory MDKSA-2005:110 addressing this issue. Please see the referenced advisory for further information.

Red Hat has released an updated advisory RHSA-2005:420-24 to address various issues affecting the kernel. Please see the advisory in Web references for more information.

Conectiva Linux has released security advisory CLSA-2005:999 addressing this and other issues. Please see the referenced advisory for details on obtaining and applying the appropriate updates.

Mandriva has released advisory MDKSA-2005:219 to address various issues affecting the Linux Kernel in Mandrake Linux 10.1. Please see the referenced advisory for more information.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.


Linux kernel 2.6.10

Linux kernel 2.6.8 rc1

Linux kernel 2.6.8

Linux kernel 2.6.9

References

Multiple Linux Kernel IOCTL Handlers Local Memory Corruption Vulnerabilities

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report