Linux Kernel up to 2.4.26 on AMD64/EM64T Call Emulator memory corruption
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
7.0 | $0-$5k | 0.00 |
A vulnerability has been found in Linux Kernel up to 2.4.26 on AMD64/EM64T (Operating System) and classified as critical. This vulnerability affects some unknown processing of the component Call Emulator. The manipulation with an unknown input leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:
Unknown vulnerability in the 32bit emulation code in Linux 2.4 on AMD64 systems allows local users to gain privileges.
The bug was discovered 12/23/2004. The weakness was shared 12/24/2004 by Petr Vandrovec with Red Hat (Website). The advisory is shared for download at rhn.redhat.com. This vulnerability was named CVE-2004-1144 since 12/06/2004. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available.
The vulnerability scanner Nessus provides a plugin with the ID 16054 (RHEL 3 : kernel (RHSA-2004:689)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Red Hat Local Security Checks and running in the context l.
Upgrading eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at ftp.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version. A possible mitigation has been published even before and not after the disclosure of the vulnerability.
The vulnerability is also documented in the databases at X-Force (18686) and Tenable (16054). The entries 752 and 1085 are related to this item.
Product
Type
Vendor
Name
Version
- 2.4.0
- 2.4.1
- 2.4.2
- 2.4.3
- 2.4.4
- 2.4.5
- 2.4.6
- 2.4.7
- 2.4.8
- 2.4.9
- 2.4.10
- 2.4.11
- 2.4.12
- 2.4.13
- 2.4.14
- 2.4.15
- 2.4.16
- 2.4.17
- 2.4.18
- 2.4.19
- 2.4.20
- 2.4.21
- 2.4.22
- 2.4.23
- 2.4.24
- 2.4.25
- 2.4.26
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 7.3VulDB Meta Temp Score: 7.0
VulDB Base Score: 7.3
VulDB Temp Score: 7.0
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Memory corruptionCWE: CWE-119
ATT&CK: Unknown
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Nessus ID: 16054
Nessus Name: RHEL 3 : kernel (RHSA-2004:689)
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍
Nessus Context: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Patch: ftp.kernel.org
Timeline
12/06/2004 🔍12/22/2004 🔍
12/22/2004 🔍
12/23/2004 🔍
12/23/2004 🔍
12/24/2004 🔍
12/24/2004 🔍
12/27/2004 🔍
12/31/2004 🔍
01/10/2005 🔍
05/26/2005 🔍
06/30/2019 🔍
Sources
Vendor: kernel.orgAdvisory: rhn.redhat.com
Researcher: Petr Vandrovec
Organization: Red Hat
Status: Not defined
CVE: CVE-2004-1144 (🔍)
OVAL: 🔍
X-Force: 18686
Vulnerability Center: 8159 - Linux kernel 2.4 Allows Gaining Elevated Privileges, High
SecurityFocus: 12079 - Linux Kernel 32 Bit Compatibility System Call Handler AMD64 Local Privilege Escalation Vulnerability
Secunia: 13627 - Linux Kernel 32bit System Call Emulation and ELF Binary Vulnerabilities, Less Critical
OSVDB: 12590 - CVE-2004-1144 - Linux - Unknown Issue
See also: 🔍
Entry
Created: 01/10/2005 10:33Updated: 06/30/2019 18:28
Changes: 01/10/2005 10:33 (80), 06/30/2019 18:28 (8)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.