high7.2Public exploit code
CVE-2003-0985
The mremap system call (do_mremap) in Linux kernel 2.4.x before 2.4.21, and possibly other versions before 2.4.24, does not properly perform bounds checks, whi…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Linux Kernel 2.4.23/2.6.0 - 'do_mremap()' Bound Checking Privilege Escalation2004-01-15 · local · linux · Verified
- Linux Kernel 2.4.23/2.6.0 - 'do_mremap()' Bound Checking Validator (2)2004-01-07 · local · linux · Verified
- Linux Kernel 2.4.23/2.6.0 - 'do_mremap()' Bound Checking Validator (1)2004-01-06 · local · linux · Verified
Impact
The mremap system call (do_mremap) in Linux kernel 2.4.x before 2.4.21, and possibly other versions before 2.4.24, does not properly perform bounds checks, which allows local users to cause a denial of service and possibly gain privileges by causing a remapping of a virtual memory area (VMA) to create a zero length VMA, a different vulnerability than CAN-2004-0077.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Linux | Linux Kernel | Versions 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.4.5 |
References
- NVD record
- CVE.org record
- http://archives.neohapsis.com/archives/bugtraq/2004-01/0070.html
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000799
- http://download.immunix.org/ImmunixOS/7.3/updates/IMNX-2004-73-001-01
- http://isec.pl/vulnerabilities/isec-0013-mremap.txt
- http://klecker.debian.org/~joey/security/kernel/patches/patch.CAN-2005-0528.mremap
- http://marc.info/?l=bugtraq&m=107332754521495&w=2
- http://marc.info/?l=bugtraq&m=107332782121916&w=2
- http://marc.info/?l=bugtraq&m=107340358402129&w=2
- http://marc.info/?l=bugtraq&m=107340814409017&w=2
- http://marc.info/?l=bugtraq&m=107350348418373&w=2
- http://marc.info/?l=bugtraq&m=107394143105081&w=2
- http://secunia.com/advisories/10532
- http://secunia.com/advisories/20163
- http://secunia.com/advisories/20202
- http://secunia.com/advisories/20338
- http://svn.debian.org/wsvn/kernel/patch-tracking/CVE-2005-0528?op=file&rev=0&sc=0
- http://www.ciac.org/ciac/bulletins/o-045.shtml
- http://www.debian.org/security/2004/dsa-413
- http://www.debian.org/security/2004/dsa-417
- http://www.debian.org/security/2004/dsa-423
- http://www.debian.org/security/2004/dsa-427
- http://www.debian.org/security/2004/dsa-439
- http://www.debian.org/security/2004/dsa-440
- http://www.debian.org/security/2004/dsa-442
- http://www.debian.org/security/2004/dsa-450