CVE-2004-0077
published 2004-03-03CVE-2004-0077: The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the…
PriorityP430high7.2CVSS 2.0
AVLACLAuNCCICAC
EXPLOIT
EPSS
2.43%
82.4th percentile
The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985.
Affected
62 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
CVSS provenance
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vendor_redhat7.2HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
security flaw
vendor_redhat·2004-02-18·CVSS 7.2
CVE-2004-0077 [HIGH] security flaw
security flaw
The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985.
Red Hat
security flaw
vendor_redhat·2004-01-05·CVSS 7.2
CVE-2003-0985 [HIGH] security flaw
security flaw
The mremap system call (do_mremap) in Linux kernel 2.4.x before 2.4.21, and possibly other versions before 2.4.24, does not properly perform bounds checks, which allows local users to cause a denial of service and possibly gain privileges by causing a remapping of a virtual memory area (VMA) to create a zero length VMA, a different vulnerability than CAN-2004-0077.
GHSA
GHSA-pm7j-3492-hq9m: The do_mremap function for the mremap system call in Linux 2
ghsa_unreviewed·2022-04-29
CVE-2004-0077 [HIGH] GHSA-pm7j-3492-hq9m: The do_mremap function for the mremap system call in Linux 2
The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985.
No detection rules found.
Exploit-DB
Linux Kernel 2.2.25/2.4.24/2.6.2 - 'mremap()' Local Privilege Escalation
exploitdb·2004-03-01
CVE-2004-0077 Linux Kernel 2.2.25/2.4.24/2.6.2 - 'mremap()' Local Privilege Escalation
Linux Kernel 2.2.25/2.4.24/2.6.2 - 'mremap()' Local Privilege Escalation
---
/*
*
* mremap missing do_munmap return check kernel exploit
*
* gcc -O3 -static -fomit-frame-pointer mremap_pte.c -o mremap_pte
* ./mremap_pte [suid] [[shell]]
*
* Vulnerable kernel versions are all
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define str(s) #s
#define xstr(s) str(s)
// this is for standard kernels with 3/1 split
#define STARTADDR 0x40000000
#define PGD_SIZE (PAGE_SIZE * 1024)
#define VICTIM (STARTADDR + PGD_SIZE)
#define MMAP_BASE (STARTADDR + 3*PGD_SIZE)
#define DSIGNAL SIGCHLD
#define CLONEFL (DSIGNAL|CLONE_VFORK|CLONE_VM)
#define MREMAP_MAYMOVE ( (1UL) 65520 )
printf("\r MMAP #%d 0x%.8x - 0x%.8lx", cnt, base,
base+PAGE_SIZE); fflus
Exploit-DB
Linux Kernel 2.2.25/2.4.24/2.6.2 - 'mremap()' Validator
exploitdb·2004-02-18·CVSS 7.2
CVE-2004-0077 [HIGH] Linux Kernel 2.2.25/2.4.24/2.6.2 - 'mremap()' Validator
Linux Kernel 2.2.25/2.4.24/2.6.2 - 'mremap()' Validator
---
/*
* Proof-of-concept exploit code for do_mremap() #2
*
* EDB Note: This is NOT to be confused with CVE-2003-0985 // https://www.exploit-db.com/exploits/141/, which would be "do_mremap() #1".
* EDB Note: This will just "test" the vulnerability. A exploit version can be found here ~ https://www.exploit-db.com/exploits/160/
*
*
* Copyright (C) 2004 Christophe Devine
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied
Bugzilla
CVE-2004-0077 security flaw
bugzilla·2018-08-16·CVSS 7.2
CVE-2004-0077 [HIGH] CVE-2004-0077 security flaw
CVE-2004-0077 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985.
Bugzilla
CVE-2003-0985 security flaw
bugzilla·2018-08-16·CVSS 7.2
CVE-2003-0985 [HIGH] CVE-2003-0985 security flaw
CVE-2003-0985 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
The mremap system call (do_mremap) in Linux kernel 2.4.x before 2.4.21, and possibly other versions before 2.4.24, does not properly perform bounds checks, which allows local users to cause a denial of service and possibly gain privileges by causing a remapping of a virtual memory area (VMA) to create a zero length VMA, a different vulnerability than CAN-2004-0077.
http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0040.htmlhttp://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000820http://fedoranews.org/updates/FEDORA-2004-079.shtmlhttp://frontal2.mandriva.com/security/advisories?name=MDKSA-2004:015http://isec.pl/vulnerabilities/isec-0014-mremap-unmap.txthttp://marc.info/?l=bugtraq&m=107711762014175&w=2http://marc.info/?l=bugtraq&m=107712137732553&w=2http://marc.info/?l=bugtraq&m=107755871932680&w=2http://security.gentoo.org/glsa/glsa-200403-02.xmlhttp://www.ciac.org/ciac/bulletins/o-082.shtmlhttp://www.debian.org/security/2004/dsa-438http://www.debian.org/security/2004/dsa-439http://www.debian.org/security/2004/dsa-440http://www.debian.org/security/2004/dsa-441http://www.debian.org/security/2004/dsa-442http://www.debian.org/security/2004/dsa-444http://www.debian.org/security/2004/dsa-450http://www.debian.org/security/2004/dsa-453http://www.debian.org/security/2004/dsa-454http://www.debian.org/security/2004/dsa-456http://www.debian.org/security/2004/dsa-466http://www.debian.org/security/2004/dsa-470http://www.debian.org/security/2004/dsa-475http://www.debian.org/security/2004/dsa-514http://www.kb.cert.org/vuls/id/981222http://www.novell.com/linux/security/advisories/2004_05_linux_kernel.htmlhttp://www.osvdb.org/3986http://www.redhat.com/support/errata/RHSA-2004-065.htmlhttp://www.redhat.com/support/errata/RHSA-2004-066.htmlhttp://www.redhat.com/support/errata/RHSA-2004-069.htmlhttp://www.redhat.com/support/errata/RHSA-2004-106.htmlhttp://www.securityfocus.com/bid/9686http://www.slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.404734https://exchange.xforce.ibmcloud.com/vulnerabilities/15244https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A825https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A837http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0040.htmlhttp://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000820http://fedoranews.org/updates/FEDORA-2004-079.shtmlhttp://frontal2.mandriva.com/security/advisories?name=MDKSA-2004:015http://isec.pl/vulnerabilities/isec-0014-mremap-unmap.txthttp://marc.info/?l=bugtraq&m=107711762014175&w=2http://marc.info/?l=bugtraq&m=107712137732553&w=2http://marc.info/?l=bugtraq&m=107755871932680&w=2http://security.gentoo.org/glsa/glsa-200403-02.xmlhttp://www.ciac.org/ciac/bulletins/o-082.shtmlhttp://www.debian.org/security/2004/dsa-438http://www.debian.org/security/2004/dsa-439http://www.debian.org/security/2004/dsa-440http://www.debian.org/security/2004/dsa-441http://www.debian.org/security/2004/dsa-442http://www.debian.org/security/2004/dsa-444http://www.debian.org/security/2004/dsa-450http://www.debian.org/security/2004/dsa-453http://www.debian.org/security/2004/dsa-454http://www.debian.org/security/2004/dsa-456http://www.debian.org/security/2004/dsa-466http://www.debian.org/security/2004/dsa-470http://www.debian.org/security/2004/dsa-475http://www.debian.org/security/2004/dsa-514http://www.kb.cert.org/vuls/id/981222http://www.novell.com/linux/security/advisories/2004_05_linux_kernel.htmlhttp://www.osvdb.org/3986http://www.redhat.com/support/errata/RHSA-2004-065.htmlhttp://www.redhat.com/support/errata/RHSA-2004-066.htmlhttp://www.redhat.com/support/errata/RHSA-2004-069.htmlhttp://www.redhat.com/support/errata/RHSA-2004-106.htmlhttp://www.securityfocus.com/bid/9686http://www.slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.404734https://exchange.xforce.ibmcloud.com/vulnerabilities/15244https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A825https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A837
2004-03-03
Published