Linux Kernel up to 2.6.21.1 memory corruption

Summaryinfo

A vulnerability was found in Linux Kernel and classified as problematic. The affected element is an unknown function. Executing a manipulation can lead to memory corruption. This vulnerability appears as CVE-2008-0352. In addition, an exploit is available.

Detailsinfo

A vulnerability classified as critical was found in Linux Kernel (Operating System). This vulnerability affects an unknown code. The manipulation with an unknown input leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect availability. CVE summarizes:

The Linux kernel 2.6.20 through 2.6.21.1 allows remote attackers to cause a denial of service (panic) via a certain IPv6 packet, possibly involving the Jumbo Payload hop-by-hop option (jumbogram).

The issue has been introduced in 02/04/2004. The weakness was presented 01/17/2008 (Website). The advisory is available at xforce.iss.net. This vulnerability was named CVE-2008-0352 since 01/17/2008. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are unknown but a public exploit is available.

It is possible to download the exploit at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 1443 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at X-Force (39643) and Exploit-DB (4893). See VDB-40214 for similar entry. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 2.6.2
• 2.6.20
• 2.6.20.1
• 2.6.20.2
• 2.6.20.3
• 2.6.20.4
• 2.6.20.5
• 2.6.20.6
• 2.6.20.7
• 2.6.20.8
• 2.6.20.9
• 2.6.20.10
• 2.6.20.11
• 2.6.20.12
• 2.6.20.13
• 2.6.20.14
• 2.6.20.15
• 2.6.21
• 2.6.21.1

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion