CVE-2004-1235
published 2005-04-14CVE-2004-1235: Race condition in the (1) load_elf_library and (2) binfmt_aout function calls for uselib in Linux kernel 2.4 through 2.429-rc2 and 2.6 through 2.6.10 allows…
PriorityP428medium6.2CVSS 2.0
AVLACHAuNCCICAC
EXPLOIT
EPSS
2.89%
86.8th percentile
Race condition in the (1) load_elf_library and (2) binfmt_aout function calls for uselib in Linux kernel 2.4 through 2.429-rc2 and 2.6 through 2.6.10 allows local users to execute arbitrary code by manipulating the VMA descriptor.
Affected
79 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| avaya | converged_communications_server | — | — |
| avaya | modular_messaging_message_storage_server | — | — |
| avaya | modular_messaging_message_storage_server | — | — |
| avaya | s8300 | — | — |
| avaya | s8300 | — | — |
| avaya | s8500 | — | — |
| avaya | s8500 | — | — |
| avaya | s8700 | — | — |
| avaya | s8700 | — | — |
| avaya | s8710 | — | — |
| avaya | s8710 | — | — |
| conectiva | linux | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
CVSS provenance
nvdv2.06.2MEDIUMAV:L/AC:H/Au:N/C:C/I:C/A:C
vendor_redhat6.2MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-pxmj-v2v3-474h: Race condition in the (1) load_elf_library and (2) binfmt_aout function calls for uselib in Linux kernel 2
ghsa_unreviewed·2022-04-29
CVE-2004-1235 [MEDIUM] GHSA-pxmj-v2v3-474h: Race condition in the (1) load_elf_library and (2) binfmt_aout function calls for uselib in Linux kernel 2
Race condition in the (1) load_elf_library and (2) binfmt_aout function calls for uselib in Linux kernel 2.4 through 2.429-rc2 and 2.6 through 2.6.10 allows local users to execute arbitrary code by manipulating the VMA descriptor.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2005-01-09
CVE-2004-1235 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Linux kernel vulnerabilities
Paul Starzetz discovered a race condition in the ELF library and a.out
binary format loaders, which can be locally exploited in several
different ways to gain root privileges. (CAN-2004-1235)
Liang Bin found a design flaw in the capability module. After this
module was loaded on demand in a running system, all unprivileged user
space processes got all kernel capabilities (thus essentially root
privileges). This is mitigated by the fact that the capability module
is loaded very early in the boot process of a standard Ubuntu system,
when no unprivileged user processes are yet running. (CAN-2004-1337)
Finally, this update fixes a memory leak in the ip_conntrack_ftp
iptables module. However, it is believed that this
Red Hat
security flaw
vendor_redhat·2005-01-06·CVSS 6.2
CVE-2004-1235 [MEDIUM] security flaw
security flaw
Race condition in the (1) load_elf_library and (2) binfmt_aout function calls for uselib in Linux kernel 2.4 through 2.429-rc2 and 2.6 through 2.6.10 allows local users to execute arbitrary code by manipulating the VMA descriptor.
No detection rules found.
Exploit-DB
Linux Kernel 2.4.x/2.6.x - 'uselib()' Local Privilege Escalation (3)
exploitdb·2005-03-22
CVE-2004-1235 Linux Kernel 2.4.x/2.6.x - 'uselib()' Local Privilege Escalation (3)
Linux Kernel 2.4.x/2.6.x - 'uselib()' Local Privilege Escalation (3)
---
/*
* pwned.c - linux 2.4 and 2.6 sys_uselib local root exploit. PRIVATE.
* it's not the best one, the ldt approach is definitively better.
* discovered may 2004. no longer private because lorian/cliph/ihaquer
* can lick my balls.
* (c) 2004 sd
* requieres cca 1gb on fs.
*/
/*
* first create fake vma structs.
*
*
* let's have 3 threads, t1, t2 and t3.
* t1 and t2 have common vm.
*
* t3:
* - wait4sig (will come back from t2)
* - write(fd3, bigmem, bigfile_size)
* - exit()
* t1:
* - fd3 = empty file
* - fd1 = bigfile, writing it took 16 secs
* - bigmem = mmap(NULL, bigfile_size, fd1, 0);
* - t3 = fork()
* - t2 = clone()
* - fd2 = munmap_file, size of ram.
* - mumem = mmap(NULL, munmap_file_size, fd2)
* - mmap(mumem,
Exploit-DB
Linux Kernel 2.4 - 'uselib()' Local Privilege Escalation (2)
exploitdb·2005-01-27
CVE-2004-1235 Linux Kernel 2.4 - 'uselib()' Local Privilege Escalation (2)
Linux Kernel 2.4 - 'uselib()' Local Privilege Escalation (2)
---
/*
* EDB Note: There's is an updated version ~ https://www.exploit-db.com/exploits/895/
*/
/*
* Linux kernel 2.4 uselib() privilege elevation exploit.
*
* original exploit source from http://isec.pl
* reference: http://isec.pl/vulnerabilities/isec-0021-uselib.txt
*
* I modified the Paul Starzetz's exploit, made it more possible
* to race successfully. The exploit still works only on 2.4 series.
* It should be also works on 2.4 SMP, but not easy.
*
* thx newbug.
*
* Tim Hsu Jan 2005.
*
*/
#define _GNU_SOURCE
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define str(s) #s
#define xstr(s) str(s)
Exploit-DB
Linux Kernel 2.4.29-rc2 - 'uselib()' Local Privilege Escalation (1)
exploitdb·2005-01-07
CVE-2004-1235 Linux Kernel 2.4.29-rc2 - 'uselib()' Local Privilege Escalation (1)
Linux Kernel 2.4.29-rc2 - 'uselib()' Local Privilege Escalation (1)
---
/*
* EDB Note: There's is an updated version ~ https://www.exploit-db.com/exploits/895/
*/
/*
* binfmt_elf uselib VMA insert race vulnerability
* v1.08
*
* gcc -O2 -fomit-frame-pointer elflbl.c -o elflbl
*
* Copyright (c) 2004 iSEC Security Research. All Rights Reserved.
*
* THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS"
* AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION
* WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED.
*
*/
#define _GNU_SOURCE
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define str(s) #s
#define xstr(s) str(s)
http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000930http://isec.pl/vulnerabilities/isec-0021-uselib.txthttp://marc.info/?l=bugtraq&m=110512575901427&w=2http://secunia.com/advisories/20162http://secunia.com/advisories/20163http://secunia.com/advisories/20202http://secunia.com/advisories/20338http://www.debian.org/security/2006/dsa-1067http://www.debian.org/security/2006/dsa-1069http://www.debian.org/security/2006/dsa-1070http://www.debian.org/security/2006/dsa-1082http://www.mandriva.com/security/advisories?name=MDKSA-2005:022http://www.novell.com/linux/security/advisories/2005_01_sr.htmlhttp://www.redhat.com/support/errata/RHSA-2005-016.htmlhttp://www.redhat.com/support/errata/RHSA-2005-017.htmlhttp://www.redhat.com/support/errata/RHSA-2005-043.htmlhttp://www.redhat.com/support/errata/RHSA-2005-092.htmlhttp://www.securityfocus.com/advisories/7804http://www.securityfocus.com/advisories/7805http://www.securityfocus.com/advisories/7806http://www.securityfocus.com/bid/12190http://www.trustix.org/errata/2005/0001/https://bugzilla.fedora.us/show_bug.cgi?id=2336https://exchange.xforce.ibmcloud.com/vulnerabilities/18800https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9567http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000930http://isec.pl/vulnerabilities/isec-0021-uselib.txthttp://marc.info/?l=bugtraq&m=110512575901427&w=2http://secunia.com/advisories/20162http://secunia.com/advisories/20163http://secunia.com/advisories/20202http://secunia.com/advisories/20338http://www.debian.org/security/2006/dsa-1067http://www.debian.org/security/2006/dsa-1069http://www.debian.org/security/2006/dsa-1070http://www.debian.org/security/2006/dsa-1082http://www.mandriva.com/security/advisories?name=MDKSA-2005:022http://www.novell.com/linux/security/advisories/2005_01_sr.htmlhttp://www.redhat.com/support/errata/RHSA-2005-016.htmlhttp://www.redhat.com/support/errata/RHSA-2005-017.htmlhttp://www.redhat.com/support/errata/RHSA-2005-043.htmlhttp://www.redhat.com/support/errata/RHSA-2005-092.htmlhttp://www.securityfocus.com/advisories/7804http://www.securityfocus.com/advisories/7805http://www.securityfocus.com/advisories/7806http://www.securityfocus.com/bid/12190http://www.trustix.org/errata/2005/0001/https://bugzilla.fedora.us/show_bug.cgi?id=2336https://exchange.xforce.ibmcloud.com/vulnerabilities/18800https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9567
2005-04-14
Published