Linux kernel poolsize_strategy buffer overflow
| linux-poolsizestrategy-bo (18819) |  High Risk |
Description:
Linux kernel is vulnerable to a buffer overflow, caused by a signedness error in the poolsize_strategy function in the random.c poolsize sysctl handler. A local attacker could exploit this vulnerability to overflow a buffer and execute arbitrary code on the system with elevated privileges or cause the system to crash.
Platforms Affected:
- Linux, Kernel 2.4.0
- Linux, Kernel 2.4.0 test5
- Linux, Kernel 2.4.0 test10
- Linux, Kernel 2.4.0 test9
- Linux, Kernel 2.4.0 test8
- Linux, Kernel 2.4.0 test7
- Linux, Kernel 2.4.0 test6
- Linux, Kernel 2.4.0 test1
- Linux, Kernel 2.4.0 test4
- Linux, Kernel 2.4.0 test3
- Linux, Kernel 2.4.0 test2
- Linux, Kernel 2.4.0 test12
- Linux, Kernel 2.4.0 test11
- Linux, Kernel 2.4.1
- Linux, Kernel 2.4.10
- Linux, Kernel 2.4.11 pre1
- Linux, Kernel 2.4.11 pre2
- Linux, Kernel 2.4.11 pre3
- Linux, Kernel 2.4.11
- Linux, Kernel 2.4.12
- Linux, Kernel 2.4.13
- Linux, Kernel 2.4.14
- Linux, Kernel 2.4.15
- Linux, Kernel 2.4.16
- Linux, Kernel 2.4.17
- Linux, Kernel 2.4.18 pre4
- Linux, Kernel 2.4.18 pre9
- Linux, Kernel 2.4.18 pre8
- Linux, Kernel 2.4.18 pre7
- Linux, Kernel 2.4.18 pre5
- Linux, Kernel 2.4.18 pre2
- Linux, Kernel 2.4.18 pre1
- Linux, Kernel 2.4.18 pre6
- Linux, Kernel 2.4.18
- Linux, Kernel 2.4.18 pre3
- Linux, Kernel 2.4.19 pre4
- Linux, Kernel 2.4.19 pre5
- Linux, Kernel 2.4.19 pre6
- Linux, Kernel 2.4.19 pre2
- Linux, Kernel 2.4.19 pre3
- Linux, Kernel 2.4.19 pre1
- Linux, Kernel 2.4.19
- Linux, Kernel 2.4.2
- Linux, Kernel 2.4.20
- Linux, Kernel 2.4.21 pre4
- Linux, Kernel 2.4.21 pre5
- Linux, Kernel 2.4.21 pre2
- Linux, Kernel 2.4.21 pre6
- Linux, Kernel 2.4.21 pre7
- Linux, Kernel 2.4.21 pre1
- Linux, Kernel 2.4.21
- Linux, Kernel 2.4.21 pre3
- Linux, Kernel 2.4.22 pre8
- Linux, Kernel 2.4.22 pre7
- Linux, Kernel 2.4.22 pre10
- Linux, Kernel 2.4.22
- Linux, Kernel 2.4.22 pre1
- Linux, Kernel 2.4.22 pre2
- Linux, Kernel 2.4.22 pre3
- Linux, Kernel 2.4.22 pre4
- Linux, Kernel 2.4.22 pre9
- Linux, Kernel 2.4.22 pre6
- Linux, Kernel 2.4.22 pre5
- Linux, Kernel 2.4.23 pre4
- Linux, Kernel 2.4.23 pre5
- Linux, Kernel 2.4.23 pre6
- Linux, Kernel 2.4.23 pre7
- Linux, Kernel 2.4.23 pre8
- Linux, Kernel 2.4.23 pre2
- Linux, Kernel 2.4.23 pre3
- Linux, Kernel 2.4.23 pre1
- Linux, Kernel 2.4.23
- Linux, Kernel 2.4.23 pre9
- Linux, Kernel 2.4.23 ow2
- Linux, Kernel 2.4.24
- Linux, Kernel 2.4.24 ow1
- Linux, Kernel 2.4.25
- Linux, Kernel 2.4.26
- Linux, Kernel 2.4.27 pre3
- Linux, Kernel 2.4.27 pre2
- Linux, Kernel 2.4.27 pre1
- Linux, Kernel 2.4.27 pre5
- Linux, Kernel 2.4.27
- Linux, Kernel 2.4.27 pre4
- Linux, Kernel 2.4.28
- Linux, Kernel 2.4.29 rc2
- Linux, Kernel 2.4.29 rc1
- Linux, Kernel 2.4.29
- Linux, Kernel 2.4.3 pre1
- Linux, Kernel 2.4.3 pre2
- Linux, Kernel 2.4.3 pre3
- Linux, Kernel 2.4.3
- Linux, Kernel 2.4.4
- Linux, Kernel 2.4.5
- Linux, Kernel 2.4.6
- Linux, Kernel 2.4.7
- Linux, Kernel 2.4.8
- Linux, Kernel 2.4.9
- Linux, Kernel 2.4.9 pre1
- Linux, Kernel 2.4.9 pre4
- Linux, Kernel 2.4.9 pre5
- Linux, Kernel 2.4.9 pre2
- Linux, Kernel 2.4.9 pre3
- Linux, Kernel 2.6.0 test2
- Linux, Kernel 2.6.0 test3
- Linux, Kernel 2.6.0 test1
- Linux, Kernel 2.6.0 test10
- Linux, Kernel 2.6.0 test11
- Linux, Kernel 2.6.0 test4
- Linux, Kernel 2.6.0 test9
- Linux, Kernel 2.6.0 test8
- Linux, Kernel 2.6.0 test7
- Linux, Kernel 2.6.0 test6
- Linux, Kernel 2.6.0 test5
- Linux, Kernel 2.6.0
- Linux, Kernel 2.6.1
- Linux, Kernel 2.6.1 rc1
- Linux, Kernel 2.6.1 rc3
- Linux, Kernel 2.6.1 rc2
- Linux, Kernel 2.6.10 rc2
- Linux, Kernel 2.6.10 rc1
- Linux, Kernel 2.6.10 rc3
- Linux, Kernel 2.6.10
- Linux, Kernel 2.6.2 rc1
- Linux, Kernel 2.6.2
- Linux, Kernel 2.6.2 rc2
- Linux, Kernel 2.6.2 rc3
- Linux, Kernel 2.6.3
- Linux, Kernel 2.6.3 rc1
- Linux, Kernel 2.6.3 rc2
- Linux, Kernel 2.6.3 rc3
- Linux, Kernel 2.6.3 rc4
- Linux, Kernel 2.6.4 rc3
- Linux, Kernel 2.6.4 rc1
- Linux, Kernel 2.6.4 rc2
- Linux, Kernel 2.6.4
- Linux, Kernel 2.6.5 rc1
- Linux, Kernel 2.6.5
- Linux, Kernel 2.6.5 rc2
- Linux, Kernel 2.6.5 rc3
- Linux, Kernel 2.6.6
- Linux, Kernel 2.6.6 rc1
- Linux, Kernel 2.6.6 rc3
- Linux, Kernel 2.6.6 rc2
- Linux, Kernel 2.6.7 rc2
- Linux, Kernel 2.6.7 rc1
- Linux, Kernel 2.6.7 rc3
- Linux, Kernel 2.6.7
- Linux, Kernel 2.6.8 rc1
- Linux, Kernel 2.6.8
- Linux, Kernel 2.6.8 rc2
- Linux, Kernel 2.6.8 rc3
- Linux, Kernel 2.6.8 rc4
- Linux, Kernel 2.6.8.1
- Linux, Kernel 2.6.9
- Linux, Kernel 2.6.9 rc4
- Linux, Kernel 2.6.9 rc3
- Linux, Kernel 2.6.9 rc2
- Linux, Kernel 2.6.9 rc1
Remedy:
Refer to FEDORA-2005-013 or FEDORA-2005-014 for patch, upgrade or suggested workaround information. See References.
Consequences:
Gain Privileges
References:
- FEDORA-2005-013, Fedora Core 4 Update: kernel-2.6.14-1.1656_FC4 at http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00014.html.
- FEDORA-2005-014, Fedora Core 4 Update: kernel-2.6.14-1.1656_FC4 at http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00014.html.
- Full-Disclosure Mailing List, Fri Jan 07 2005 - 12:18:53 CST , grsecurity 2.1.0 release / 5 Linux kernel advisories at http://archives.neohapsis.com/archives/fulldisclosure/2005-01/0225.html.
- BID-12196: Linux Kernel Random Poolsize SysCTL Handler Integer Overflow Vulnerability
Reported:
Jan 10, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net