CVE-2000-0219 in Linux
Summary
by MITRE
Red Hat 6.0 allows local users to gain root access by booting single user and hitting ^C at the password prompt.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 12/03/2024
This vulnerability exists in Red Hat Linux version 6.0 and represents a critical privilege escalation flaw that allows local attackers to obtain root access through a specific boot sequence manipulation. The vulnerability stems from the system's handling of single user mode boot processes, where an attacker can interrupt the normal boot sequence to access a root shell without proper authentication. When the system boots into single user mode, the normal password prompt is bypassed, allowing immediate root access to anyone who can physically interact with the system during this vulnerable state.
The technical flaw resides in the operating system's boot process management and authentication handling mechanisms. During single user mode initialization, the system should enforce proper authentication checks before granting root privileges, but this validation is bypassed when the user interrupts the boot process with control-c. This creates an unintended execution path where the system transitions to a root shell environment without requiring password verification. The vulnerability specifically affects the init process and its handling of boot parameters, allowing attackers to manipulate the system state through simple keyboard interrupts.
The operational impact of this vulnerability is severe as it provides local attackers with complete system control without requiring any network access or complex exploitation techniques. An attacker with physical access to the system can simply reboot the machine, interrupt the boot process at the appropriate moment, and immediately gain root privileges. This vulnerability essentially eliminates the need for password guessing, credential theft, or other complex attack vectors, making it particularly dangerous in environments where physical security is inadequate. The attack requires minimal technical skill and can be executed by anyone familiar with basic system boot procedures.
This vulnerability aligns with CWE-284, which addresses improper access control in operating systems, and represents a classic example of insufficient privilege separation during system initialization. The flaw demonstrates poor adherence to the principle of least privilege and inadequate system state management during boot processes. From an attack perspective, this vulnerability maps to several ATT&CK techniques including privilege escalation through boot or logon initialization scripts, and system binary exploitation. The vulnerability also relates to CWE-787, which covers out-of-bounds write conditions, as the improper handling of boot state transitions can lead to unauthorized access to system resources. Mitigation strategies should include disabling single user mode boot options, implementing proper boot authentication mechanisms, and ensuring that physical access controls are maintained. System administrators should also consider implementing additional security measures such as encrypted boot processes and secure boot configurations to prevent unauthorized manipulation of system initialization sequences.