ID CVE-2005-2456
Summary Array index overflow in the xfrm_sk_policy_insert function in xfrm_user.c in Linux kernel 2.6 allows local users to cause a denial of service (oops or deadlock) and possibly execute arbitrary code via a p->dir value that is larger than XFRM_POLICY_OUT, which is used as an index in the sock->sk_policy array.
References
Vulnerable Configurations
  • cpe:2.3:o:linux:linux_kernel:2.6.0:*:*:*:*:*:*:*
    cpe:2.3:o:linux:linux_kernel:2.6.0:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:*
CVSS
Base: 2.1 (as of 09-02-2024 - 00:44)
Impact:
Exploitability:
CWE CWE-667
CAPEC
  • Leveraging Race Conditions via Symbolic Links
    This attack leverages the use of symbolic links (Symlinks) in order to write to sensitive files. An attacker can create a Symlink link to a target file not otherwise accessible to her. When the privileged program tries to create a temporary file with the same name as the Symlink link, it will actually write to the target file pointed to by the attackers' Symlink link. If the attacker can insert malicious content in the temporary file she will be writing to the sensitive file by using the Symlink. The race occurs because the system checks if the temporary file exists, then creates the file. The attacker would typically create the Symlink during the interval between the check and the creation of the temporary file.
  • Forced Deadlock
    The adversary triggers and exploits a deadlock condition in the target software to cause a denial of service. A deadlock can occur when two or more competing actions are waiting for each other to finish, and thus neither ever does. Deadlock conditions can be difficult to detect.
  • Leveraging Race Conditions
    The adversary targets a race condition occurring when multiple processes access and manipulate the same resource concurrently, and the outcome of the execution depends on the particular order in which the access takes place. The adversary can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance, a race condition can occur while accessing a file: the adversary can trick the system by replacing the original file with his version and cause the system to read the malicious file.
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:L/AC:L/Au:N/C:N/I:N/A:P
oval via4
accepted 2013-04-29T04:09:25.515-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 3
    oval oval:org.mitre.oval:def:11782
  • comment CentOS Linux 3.x
    oval oval:org.mitre.oval:def:16651
  • comment The operating system installed on the system is Red Hat Enterprise Linux 4
    oval oval:org.mitre.oval:def:11831
  • comment CentOS Linux 4.x
    oval oval:org.mitre.oval:def:16636
  • comment Oracle Linux 4.x
    oval oval:org.mitre.oval:def:15990
description sk_policy array.
family unix
id oval:org.mitre.oval:def:10858
status accepted
submitted 2010-07-09T03:56:16-04:00
title Array index overflow in the xfrm_sk_policy_insert function in xfrm_user.c in Linux kernel 2.6 allows local users to cause a denial of service (oops or deadlock) and possibly execute arbitrary code via a p-dir value that is larger than XFRM_POLICY_OUT, which is used as an index in the sock-sk_policy array.
version 29
redhat via4
advisories
  • rhsa
    id RHSA-2005:514
  • rhsa
    id RHSA-2005:663
rpms
  • kernel-0:2.6.9-22.EL
  • kernel-debuginfo-0:2.6.9-22.EL
  • kernel-devel-0:2.6.9-22.EL
  • kernel-doc-0:2.6.9-22.EL
  • kernel-hugemem-0:2.6.9-22.EL
  • kernel-hugemem-devel-0:2.6.9-22.EL
  • kernel-smp-0:2.6.9-22.EL
  • kernel-smp-devel-0:2.6.9-22.EL
  • kernel-0:2.4.21-37.EL
  • kernel-BOOT-0:2.4.21-37.EL
  • kernel-debuginfo-0:2.4.21-37.EL
  • kernel-doc-0:2.4.21-37.EL
  • kernel-hugemem-0:2.4.21-37.EL
  • kernel-hugemem-unsupported-0:2.4.21-37.EL
  • kernel-smp-0:2.4.21-37.EL
  • kernel-smp-unsupported-0:2.4.21-37.EL
  • kernel-source-0:2.4.21-37.EL
  • kernel-unsupported-0:2.4.21-37.EL
refmap via4
bid 14477
confirm
debian
  • DSA-921
  • DSA-922
fedora FLSA:157459-3
mandrake
  • MDKSA-2005:219
  • MDKSA-2005:220
misc http://www.mail-archive.com/netdev@vger.kernel.org/msg00520.html
secunia
  • 16298
  • 16500
  • 17002
  • 17073
  • 17826
  • 18056
  • 18059
suse SUSE-SA:2005:050
ubuntu USN-169-1
vupen ADV-2005-1878
xf linux-kernel-xfrm-dos(21710)
Last major update 09-02-2024 - 00:44
Published 04-08-2005 - 04:00
Last modified 09-02-2024 - 00:44
Back to Top