Published: 03/03/2004 Updated: 03/05/2018

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

VMScore: 730

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redhat kernel 2.4.20-8
redhat kernel doc 2.4.20-8
redhat bigmem kernel 2.4.20-8
linux linux_kernel 2.2.1
linux linux_kernel 2.2.10
linux linux_kernel 2.2.16
linux linux_kernel 2.2.22
linux linux_kernel 2.2.23
linux linux_kernel 2.2.8
linux linux_kernel 2.2.9
linux linux_kernel 2.4.0
linux linux_kernel 2.2.11
linux linux_kernel 2.2.12
linux linux_kernel 2.2.17
linux linux_kernel 2.2.18
linux linux_kernel 2.2.24
linux linux_kernel 2.2.3
linux linux_kernel 2.4.13
linux linux_kernel 2.4.14
linux linux_kernel 2.4.18
linux linux_kernel 2.4.19
linux linux_kernel 2.4.21
linux linux_kernel 2.4.5
linux linux_kernel 2.4.6
linux linux_kernel 2.6.0
linux linux_kernel 2.6.1
linux linux_kernel 2.4.11
linux linux_kernel 2.4.12
linux linux_kernel 2.4.20
linux linux_kernel 2.4.24
linux linux_kernel 2.4.3
linux linux_kernel 2.4.4
trustix secure_linux 2.0
redhat kernel_source 2.4.20-8
linux linux_kernel 2.2.0
linux linux_kernel 2.2.15
linux linux_kernel 2.2.15_pre20
linux linux_kernel 2.2.20
linux linux_kernel 2.2.21
linux linux_kernel 2.2.6
linux linux_kernel 2.2.7
linux linux_kernel 2.4.1
linux linux_kernel 2.4.10
linux linux_kernel 2.4.17
linux linux_kernel 2.4.2
linux linux_kernel 2.4.23
linux linux_kernel 2.4.9
linux linux_kernel 2.6_test9_cvs
netwosix netwosix_linux 1.0
trustix secure_linux 1.5
linux linux_kernel 2.2.13
linux linux_kernel 2.2.14
linux linux_kernel 2.2.19
linux linux_kernel 2.2.2
linux linux_kernel 2.2.4
linux linux_kernel 2.2.5
linux linux_kernel 2.4.15
linux linux_kernel 2.4.16
linux linux_kernel 2.4.22
linux linux_kernel 2.4.7
linux linux_kernel 2.4.8
linux linux_kernel 2.6.2

Several local root exploits have been discovered recently in the Linux kernel This security advisory updates the hppa kernel 2417 for Debian GNU/Linux The Common Vulnerabilities and Exposures project identifies the following problems that are fixed with this update: CAN-2003-0961: An integer overflow in brk() system call (do_brk() function) ...

Paul Starzetz and Wojciech Purczynski of isecpl discovered a critical security vulnerability in the memory management code of Linux inside the mremap(2) system call Due to flushing the TLB (Translation Lookaside Buffer, an address cache) too early it is possible for an attacker to trigger a local root exploit The attack vectors for 24x and 22 ...

Paul Starzetz and Wojciech Purczynski of isecpl discovered a critical security vulnerability in the memory management code of Linux inside the mremap(2) system call Due to missing function return value check of internal functions a local attacker can gain root privileges For the stable distribution (woody) this problem has been fixed in version ...

Several local root exploits have been discovered recently in the Linux kernel This security advisory updates the mips kernel 2419 for Debian GNU/Linux The Common Vulnerabilities and Exposures project identifies the following problems that are fixed with this update: CAN-2003-0961: An integer overflow in brk() system call (do_brk() function) ...

Several local root exploits have been discovered recently in the Linux kernel This security advisory updates the PA-RISC kernel 2418 for Debian GNU/Linux The Common Vulnerabilities and Exposures project identifies the following problems that are fixed with this update: CAN-2003-0961: An integer overflow in brk() system call (do_brk() functi ...

Several security related problems have been fixed in the Linux kernel 2417 used for the S/390 architecture, mostly by backporting fixes from 2418 and incorporating recent security fixes The corrections are listed below with the identification from the Common Vulnerabilities and Exposures (CVE) project: CVE-2002-0429: The iBCS routines in a ...

Several local root exploits have been discovered recently in the Linux kernel This security advisory updates the PowerPC/Apus kernel for Debian GNU/Linux The Common Vulnerabilities and Exposures project identifies the following problems that are fixed with this update: CAN-2003-0961: An integer overflow in brk() system call (do_brk() function ...

/* * Proof-of-concept exploit code for do_mremap() #2 * * EDB Note: This is NOT to be confused with CVE-2003-0985 // wwwexploit-dbcom/exploits/141/, which would be "do_mremap() #1" * EDB Note: This will just "test" the vulnerability A exploit version can be found here ~ wwwexploit-dbcom/exploits/160/ * * * Copyright ( ...

/* * * mremap missing do_munmap return check kernel exploit * * gcc -O3 -static -fomit-frame-pointer mremap_ptec -o mremap_pte * /mremap_pte [suid] [[shell]] * * Vulnerable kernel versions are all <= 2225, <= 2424 and <= 262 * * Copyright (c) 2004 iSEC Security Research All Rights Reserved * * THIS PROGRAM IS FOR EDU ...

Get Started

CVE-2004-0077

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect