CVE-2005-2456
published 2005-08-04CVE-2005-2456: Array index overflow in the xfrm_sk_policy_insert function in xfrm_user.c in Linux kernel 2.6 allows local users to cause a denial of service (oops or…
PriorityP418medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.38%
30.3th percentile
Array index overflow in the xfrm_sk_policy_insert function in xfrm_user.c in Linux kernel 2.6 allows local users to cause a denial of service (oops or deadlock) and possibly execute arbitrary code via a p->dir value that is larger than XFRM_POLICY_OUT, which is used as an index in the sock->sk_policy array.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| linux | linux_kernel | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:N/A:P
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2005-08-19
CVE-2005-2548 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Linux kernel vulnerabilities
David Howells discovered a local Denial of Service vulnerability in
the key session joining function. Under certain user-triggerable
conditions, a semaphore was not released properly, which caused
processes which also attempted to join a key session to hang forever.
This only affects Ubuntu 5.04 (Hoary Hedgehog). (CAN-2005-2098)
David Howells discovered a local Denial of Service vulnerability in
the keyring allocator. A local attacker could exploit this to crash
the kernel by attempting to add a specially crafted invalid keyring.
This only affects Ubuntu 5.04 (Hoary Hedgehog). (CAN-2005-2099)
Balazs Scheidler discovered a local Denial of Service vulnerability in
the xfrm_compile_policy() function. By calling sets
Red Hat
security flaw
vendor_redhat·2005-07-25·CVSS 5.5
CVE-2005-2456 [MEDIUM] security flaw
security flaw
Array index overflow in the xfrm_sk_policy_insert function in xfrm_user.c in Linux kernel 2.6 allows local users to cause a denial of service (oops or deadlock) and possibly execute arbitrary code via a p->dir value that is larger than XFRM_POLICY_OUT, which is used as an index in the sock->sk_policy array.
GHSA
GHSA-2qg3-v24w-xhmx: Array index overflow in the xfrm_sk_policy_insert function in xfrm_user
ghsa_unreviewed·2022-05-01
CVE-2005-2456 [LOW] CWE-667 GHSA-2qg3-v24w-xhmx: Array index overflow in the xfrm_sk_policy_insert function in xfrm_user
Array index overflow in the xfrm_sk_policy_insert function in xfrm_user.c in Linux kernel 2.6 allows local users to cause a denial of service (oops or deadlock) and possibly execute arbitrary code via a p->dir value that is larger than XFRM_POLICY_OUT, which is used as an index in the sock->sk_policy array.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2005-2456 security flaw
bugzilla·2018-08-16·CVSS 5.5
CVE-2005-2456 [MEDIUM] CVE-2005-2456 security flaw
CVE-2005-2456 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
Array index overflow in the xfrm_sk_policy_insert function in xfrm_user.c in Linux kernel 2.6 allows local users to cause a denial of service (oops or deadlock) and possibly execute arbitrary code via a p->dir value that is larger than XFRM_POLICY_OUT, which is used as an index in the sock->sk_policy array.
Bugzilla
CVE-2005-2456 IPSEC overflow
bugzilla·2005-08-10·CVSS 5.5
CVE-2005-2456 [MEDIUM] CVE-2005-2456 IPSEC overflow
CVE-2005-2456 IPSEC overflow
+++ This bug was initially created as a clone of Bug #165560 +++
When a user specified IPSEC rule to compile is given, we don't check
the bounds of the direction, leading to overflows of the in-socket
IPSEC rule array. This could allow a local unprivileged user to cause memory
corruption.
Fixed upstream here on 20050726
http://linux.bkbits.net:8080/linux-2.6/cset@42e6bc85npULs5heBLcOs_2M2zCpQ
See the following threads for a test program and more desciprtion
http://www.mail-archive.com/[email protected]/msg00520.html
http://www.mail-archive.com/[email protected]/msg00523.html
Note that a fix for this is already committed for RHEL4 U2 in
linux-2.6.12-network.patch
This doesn't affect 2.4 upstream however RHEL3 contains this functionality as a
bac
Bugzilla
Multiple Kernel vulnerabilities
bugzilla·2005-05-11
[MEDIUM] Multiple Kernel vulnerabilities
Multiple Kernel vulnerabilities
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Mozilla rulez!)
Description of problem:
Paul Starzetz of iSEC has found yet another bug in binfmt_elf.c. It can be abused to crash the kernel, perhaps even to break into the kernel land. See the advisory for details.
Version-Release number of selected component (if applicable):
How reproducible:
Didn't try
Steps to Reproduce:
Additional info:
I've got a quick and dirty patch. I'll submit it ASAP.
Discussion:
Grr...Bugzilla assigned the bug to [email protected] rather than to
[email protected]
---
Created attachment 114264
The patch for CAN-2005-1263
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This patch can be applied to FL kernel 2.4.20-43:
402e548b02382c015d6f5e5704370a1ba546598b
li
CWE
Deadlock
mitre_cwe·CVSS 2.1
[LOW] CWE-833 Deadlock
CWE-833: Deadlock
The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Availability. Impact: DoS: Resource Consumption (CPU), DoS: Resource Consumption (Other), DoS: Crash, Exit, or Restart. Each thread of execution will "hang" and prevent tasks from completing. In some cases, CPU consumption may occur if a lock check occurs in a tight loop.
Detection Methods:
Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done
CWE
Improper Validation of Array Index
mitre_cwe
CWE-129 Improper Validation of Array Index
CWE-129: Improper Validation of Array Index
The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Integrity, Availability. Impact: DoS: Crash, Exit, or Restart. Use of an index that is outside the bounds of an array will very likely result in the corruption of relevant memory and perhaps instructions, leading to a crash, if the values are outside of the valid memory area.
Scope: Integrity. Impact: Modify Memory. If the memory corrupted is data, rather than instructions, the system will continue to function with improper values.
Scope: Confidentiality, Integrity.
CWE
Improper Locking
mitre_cwe
CWE-667 Improper Locking
CWE-667: Improper Locking
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
Locking is a type of synchronization behavior that ensures that multiple independently-operating processes or threads do not interfere with each other when accessing the same resource. All processes/threads are expected to follow the same steps for locking. If these steps are not followed precisely - or if no locking is done at all - then another process/thread could modify the shared resource in a way that is not visible or predictable to the original process. This can lead to data or memory corruption, denial of service, etc.
Modes of Introduction:
Phase: Architecture and Design
Phase: Implementation
Common Consequences:
Scope: A
http://secunia.com/advisories/16298http://secunia.com/advisories/16500http://secunia.com/advisories/17002http://secunia.com/advisories/17073http://secunia.com/advisories/17826http://secunia.com/advisories/18056http://secunia.com/advisories/18059http://www.debian.org/security/2005/dsa-921http://www.debian.org/security/2005/dsa-922http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=blobdiff%3Bh=8da3e25b2c4c1f305fd85428d3a9eb62b543bfba%3Bhp=ecade4893a139cc35d4fe345ce70242ede5358c4%3Bhb=a4f1bac62564049ea4718c4624b0fadc9f597c84%3Bf=net/xfrm/xfrm_user.chttp://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a4f1bac62564049ea4718c4624b0fadc9f597c84http://www.mail-archive.com/netdev%40vger.kernel.org/msg00520.htmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2005:219http://www.mandriva.com/security/advisories?name=MDKSA-2005:220http://www.novell.com/linux/security/advisories/2005_50_kernel.htmlhttp://www.redhat.com/support/errata/RHSA-2005-514.htmlhttp://www.redhat.com/support/errata/RHSA-2005-663.htmlhttp://www.securityfocus.com/archive/1/427980/100/0/threadedhttp://www.securityfocus.com/bid/14477http://www.vupen.com/english/advisories/2005/1878https://exchange.xforce.ibmcloud.com/vulnerabilities/21710https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10858https://usn.ubuntu.com/169-1/http://secunia.com/advisories/16298http://secunia.com/advisories/16500http://secunia.com/advisories/17002http://secunia.com/advisories/17073http://secunia.com/advisories/17826http://secunia.com/advisories/18056http://secunia.com/advisories/18059http://www.debian.org/security/2005/dsa-921http://www.debian.org/security/2005/dsa-922http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=blobdiff%3Bh=8da3e25b2c4c1f305fd85428d3a9eb62b543bfba%3Bhp=ecade4893a139cc35d4fe345ce70242ede5358c4%3Bhb=a4f1bac62564049ea4718c4624b0fadc9f597c84%3Bf=net/xfrm/xfrm_user.chttp://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a4f1bac62564049ea4718c4624b0fadc9f597c84http://www.mail-archive.com/netdev%40vger.kernel.org/msg00520.htmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2005:219http://www.mandriva.com/security/advisories?name=MDKSA-2005:220http://www.novell.com/linux/security/advisories/2005_50_kernel.htmlhttp://www.redhat.com/support/errata/RHSA-2005-514.htmlhttp://www.redhat.com/support/errata/RHSA-2005-663.htmlhttp://www.securityfocus.com/archive/1/427980/100/0/threadedhttp://www.securityfocus.com/bid/14477http://www.vupen.com/english/advisories/2005/1878https://exchange.xforce.ibmcloud.com/vulnerabilities/21710https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10858https://usn.ubuntu.com/169-1/
2005-08-04
Published