CVE-2004-1057
published 2005-01-21CVE-2004-1057: Multiple drivers in Linux kernel 2.4.19 and earlier do not properly mark memory with the VM_IO flag, which causes incorrect reference counts and may lead to a…
PriorityP417high7.2CVSS 2.0
AVLACLAuNCCICAC
EPSS
0.42%
34.2th percentile
Multiple drivers in Linux kernel 2.4.19 and earlier do not properly mark memory with the VM_IO flag, which causes incorrect reference counts and may lead to a denial of service (kernel panic) when accessing freed kernel pages.
Affected
90 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux_kernel | <= 2.4.19 | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
CVSS provenance
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vendor_redhat7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-gw46-hc5v-7grj: Multiple drivers in Linux kernel 2
ghsa_unreviewed·2022-04-29
CVE-2004-1057 [HIGH] GHSA-gw46-hc5v-7grj: Multiple drivers in Linux kernel 2
Multiple drivers in Linux kernel 2.4.19 and earlier do not properly mark memory with the VM_IO flag, which causes incorrect reference counts and may lead to a denial of service (kernel panic) when accessing freed kernel pages.
Red Hat
security flaw
vendor_redhat·2005-01-07·CVSS 7.2
CVE-2004-1057 [HIGH] security flaw
security flaw
Multiple drivers in Linux kernel 2.4.19 and earlier do not properly mark memory with the VM_IO flag, which causes incorrect reference counts and may lead to a denial of service (kernel panic) when accessing freed kernel pages.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2004-1057 security flaw
bugzilla·2018-08-16·CVSS 7.2
CVE-2004-1057 [HIGH] CVE-2004-1057 security flaw
CVE-2004-1057 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
Multiple drivers in Linux kernel 2.4.19 and earlier do not properly mark memory with the VM_IO flag, which causes incorrect reference counts and may lead to a denial of service (kernel panic) when accessing freed kernel pages.
Bugzilla
CVE-2004-1057 VM_IO refcount issue
bugzilla·2004-11-01·CVSS 7.2
CVE-2004-1057 [HIGH] CVE-2004-1057 VM_IO refcount issue
CVE-2004-1057 VM_IO refcount issue
Created attachment 106045
Patch for this issue.
This patch was taken from
http://www.kernel.org/pub/linux/kernel/people/andrea/kernels/v2.4/2.4.23aa3/00_VM_IO-4
Discussion:
The issue is fairly simple in its basis. When a driver allocates resources and
marks the pages PG_Private (for DMA use) the pages are no longer refcounted.
Now imagine someone doing O_DIRECT dma on an audio mmap and closing the mmap.
Not pretty 8)
The needed fix as far as I can see for RHEL3 is to set VM_IO (ie disallow the
O_DIRECT) in remap_page_range(). We can do that because unlike base 2.4 we
happen to pass the vma into the function.
---
This is the 2.6 addition (which is like our 2.4 because we pass the vma for Riel mm)
/*
* Physically remapped pages are special. Tell t
http://secunia.com/advisories/18562http://www.kernel.org/pub/linux/kernel/people/andrea/kernels/v2.4/2.4.23aa3/00_VM_IO-4http://www.redhat.com/support/errata/RHSA-2005-016.htmlhttp://www.redhat.com/support/errata/RHSA-2005-017.htmlhttp://www.redhat.com/support/errata/RHSA-2006-0140.htmlhttp://www.securityfocus.com/bid/12338https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=137821https://exchange.xforce.ibmcloud.com/vulnerabilities/19275https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11474http://secunia.com/advisories/18562http://www.kernel.org/pub/linux/kernel/people/andrea/kernels/v2.4/2.4.23aa3/00_VM_IO-4http://www.redhat.com/support/errata/RHSA-2005-016.htmlhttp://www.redhat.com/support/errata/RHSA-2005-017.htmlhttp://www.redhat.com/support/errata/RHSA-2006-0140.htmlhttp://www.securityfocus.com/bid/12338https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=137821https://exchange.xforce.ibmcloud.com/vulnerabilities/19275https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11474
2005-01-21
Published