CVE-2006-2935
published 2006-07-05CVE-2006-2935: The dvd_read_bca function in the DVD handling code in drivers/cdrom/cdrom.c in Linux kernel 2.2.16, and later versions, assigns the wrong value to a length…
PriorityP420medium4.6CVSS 2.0
AVLACLAuNCPIPAP
EPSS
0.57%
44.2th percentile
The dvd_read_bca function in the DVD handling code in drivers/cdrom/cdrom.c in Linux kernel 2.2.16, and later versions, assigns the wrong value to a length variable, which allows local users to execute arbitrary code via a crafted USB Storage device that triggers a buffer overflow.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| linux | linux_kernel | 2.2.16 – 2.16.16 | — |
CVSS provenance
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
vendor_ubuntu5.0MEDIUM
vendor_redhat4.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-gchf-2fmf-p9hf: The dvd_read_bca function in the DVD handling code in drivers/cdrom/cdrom
ghsa_unreviewed·2022-05-01
CVE-2006-2935 [MEDIUM] CWE-120 GHSA-gchf-2fmf-p9hf: The dvd_read_bca function in the DVD handling code in drivers/cdrom/cdrom
The dvd_read_bca function in the DVD handling code in drivers/cdrom/cdrom.c in Linux kernel 2.2.16, and later versions, assigns the wrong value to a length variable, which allows local users to execute arbitrary code via a crafted USB Storage device that triggers a buffer overflow.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2006-09-15·CVSS 5.0
CVE-2006-2934 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Linux kernel vulnerabilities
A Denial of service vulnerability was reported in iptables' SCTP
conntrack module. On computers which use this iptables module, a
remote attacker could expoit this to trigger a kernel crash.
(CVE-2006-2934)
A buffer overflow has been discovered in the dvd_read_bca() function.
By inserting a specially crafted DVD, USB stick, or similar
automatically mounted removable device, a local user could crash the
machine or potentially even execute arbitrary code with full root
privileges. (CVE-2006-2935)
The ftdi_sio driver for serial USB ports did not limit the amount of
pending data to be written. A local user could exploit this to drain
all available kernel memory and thus render the system unusable.
(CVE-2006-2936)
Ja
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2006-08-03·CVSS 5.0
CVE-2006-2934 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Linux kernel vulnerabilities
A Denial of service vulnerability was reported in iptables' SCTP
conntrack module. On computers which use this iptables module, a
remote attacker could expoit this to trigger a kernel crash.
(CVE-2006-2934)
A buffer overflow has been discovered in the dvd_read_bca() function.
By inserting a specially crafted DVD, USB stick, or similar
automatically mounted removable device, a local user could crash the
machine or potentially even execute arbitrary code with full root
privileges. (CVE-2006-2935)
The ftdi_sio driver for serial USB ports did not limit the amount of
pending data to be written. A local user could exploit this to drain
all available kernel memory and thus render the system unusable.
(CVE-2006-2936)
Ad
Red Hat
security flaw
vendor_redhat·2006-06-27·CVSS 4.6
CVE-2006-2935 [MEDIUM] security flaw
security flaw
The dvd_read_bca function in the DVD handling code in drivers/cdrom/cdrom.c in Linux kernel 2.2.16, and later versions, assigns the wrong value to a length variable, which allows local users to execute arbitrary code via a crafted USB Storage device that triggers a buffer overflow.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2006-2935 security flaw
bugzilla·2018-08-16·CVSS 4.6
CVE-2006-2935 [MEDIUM] CVE-2006-2935 security flaw
CVE-2006-2935 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
The dvd_read_bca function in the DVD handling code in drivers/cdrom/cdrom.c in Linux kernel 2.2.16, and later versions, assigns the wrong value to a length variable, which allows local users to execute arbitrary code via a crafted USB Storage device that triggers a buffer overflow.
Bugzilla
Various kernel security issues - July thru October 2006
bugzilla·2006-07-24·CVSS 4.9
[MEDIUM] Various kernel security issues - July thru October 2006
Various kernel security issues - July thru October 2006
This bug will track the various kernel issues up to July 2006.
Discussion:
*** Bug 188935 has been marked as a duplicate of this bug. ***
---
*** Bug 190082 has been marked as a duplicate of this bug. ***
---
*** Bug 190083 has been marked as a duplicate of this bug. ***
---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Here are updated kernel packages to QA for FC3:
* Sun Jul 16 2006 Marc Deslauriers
2.6.12-2.4.legacy_FC3
- - Added patches for:
CVE-2005-3359 (incorrect inrement/decrement in atm module)
CVE-2006-0555 (nfs: fix client panic using O_DIRECT)
CVE-2006-0741 (fix for ELF exec vulnerability on EM64T)
CVE-2006-0744 (fix for ELF exec vulnerability on EM64T)
CVE-2006-1525 (panic in ip_route_input() via inet_rtm_getro
Bugzilla
CVE-2006-2935 Possible buffer overflow in DVD handling
bugzilla·2006-07-05·CVSS 4.6
CVE-2006-2935 [MEDIUM] CVE-2006-2935 Possible buffer overflow in DVD handling
CVE-2006-2935 Possible buffer overflow in DVD handling
Reported by Marcus Meissner to the Kernel Bugzilla:
http://bugzilla.kernel.org/show_bug.cgi?id=2966
The dvd_read_bca() function in drivers/cdrom/cdrom.c shows a potential buffer
overflow.
The variable buf[4+188] is allocated on the stack, however cgc.cmd[9] and
cgc.buflen are set to 255:
cgc.cmd[9] = cgc.buflen = 0xff;
This can be exploited by a custom made USB Storage device and used for local
privilege escalation (aka plug-in this USB device to get root).
This function has been introduced in 2.2.16 (back in 2000) and as of today it
hasn't changed. Jens Axboe confirmed that this is a typo and it should read:
cgc.cmd[9] = cgc.buflen & 0xff;
It is to mask high bits of the length. It doesn't use the high 8 bits for
transfer leng
Bugzilla
CVE-2006-2935 Possible buffer overflow in DVD handling
bugzilla·2006-07-05·CVSS 4.6
CVE-2006-2935 [MEDIUM] CVE-2006-2935 Possible buffer overflow in DVD handling
CVE-2006-2935 Possible buffer overflow in DVD handling
Reported by Marcus Meissner to the Kernel Bugzilla:
http://bugzilla.kernel.org/show_bug.cgi?id=2966
The dvd_read_bca() function in drivers/cdrom/cdrom.c shows a potential buffer
overflow.
The variable buf[4+188] is allocated on the stack, however cgc.cmd[9] and
cgc.buflen are set to 255:
cgc.cmd[9] = cgc.buflen = 0xff;
This can be exploited by a custom made USB Storage device and used for local
privilege escalation (aka plug-in this USB device to get root).
This function has been introduced in 2.2.16 (back in 2000) and as of today it
hasn't changed. Jens Axboe confirmed that this is a typo and it should read:
cgc.cmd[9] = cgc.buflen & 0xff;
It is to mask high bits of the length. It doesn't use the high 8 bits for
transfer leng
Bugzilla
CVE-2006-2935 Possible buffer overflow in DVD handling
bugzilla·2006-07-05·CVSS 4.6
CVE-2006-2935 [MEDIUM] CVE-2006-2935 Possible buffer overflow in DVD handling
CVE-2006-2935 Possible buffer overflow in DVD handling
Reported by Marcus Meissner to the Kernel Bugzilla:
http://bugzilla.kernel.org/show_bug.cgi?id=2966
The dvd_read_bca() function in drivers/cdrom/cdrom.c shows a potential buffer
overflow.
The variable buf[4+188] is allocated on the stack, however cgc.cmd[9] and
cgc.buflen are set to 255:
cgc.cmd[9] = cgc.buflen = 0xff;
This can be exploited by a custom made USB Storage device and used for local
privilege escalation (aka plug-in this USB device to get root).
This function has been introduced in 2.2.16 (back in 2000) and as of today it
hasn't changed. Jens Axboe confirmed that this is a typo and it should read:
cgc.cmd[9] = cgc.buflen & 0xff;
It is to mask high bits of the length. It doesn't use the high 8 bits for
transfer leng
Bugzilla
CVE-2006-2935 Possible buffer overflow in DVD handling
bugzilla·2006-07-05·CVSS 4.6
CVE-2006-2935 [MEDIUM] CVE-2006-2935 Possible buffer overflow in DVD handling
CVE-2006-2935 Possible buffer overflow in DVD handling
Reported by Marcus Meissner to the Kernel Bugzilla:
http://bugzilla.kernel.org/show_bug.cgi?id=2966
The dvd_read_bca() function in drivers/cdrom/cdrom.c shows a potential buffer
overflow.
The variable buf[4+188] is allocated on the stack, however cgc.cmd[9] and
cgc.buflen are set to 255:
cgc.cmd[9] = cgc.buflen = 0xff;
This can be exploited by a custom made USB Storage device and used for local
privilege escalation (aka plug-in this USB device to get root).
This function has been introduced in 2.2.16 (back in 2000) and as of today it
hasn't changed. Jens Axboe confirmed that this is a typo and it should read:
cgc.cmd[9] = cgc.buflen & 0xff;
It is to mask high bits of the length. It doesn't use the high 8 bits for
transfer leng
http://bugzilla.kernel.org/show_bug.cgi?id=2966http://secunia.com/advisories/21179http://secunia.com/advisories/21298http://secunia.com/advisories/21498http://secunia.com/advisories/21605http://secunia.com/advisories/21614http://secunia.com/advisories/21695http://secunia.com/advisories/21934http://secunia.com/advisories/22082http://secunia.com/advisories/22093http://secunia.com/advisories/22174http://secunia.com/advisories/22497http://secunia.com/advisories/22822http://secunia.com/advisories/23064http://secunia.com/advisories/23788http://secunia.com/advisories/24288http://support.avaya.com/elmodocs2/security/ASA-2006-203.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-254.htmhttp://support.avaya.com/elmodocs2/security/ASA-2007-078.htmhttp://www.debian.org/security/2006/dsa-1183http://www.debian.org/security/2006/dsa-1184http://www.mandriva.com/security/advisories?name=MDKSA-2006:150http://www.mandriva.com/security/advisories?name=MDKSA-2006:151http://www.novell.com/linux/security/advisories/2006_42_kernel.htmlhttp://www.novell.com/linux/security/advisories/2006_47_kernel.htmlhttp://www.novell.com/linux/security/advisories/2006_49_kernel.htmlhttp://www.novell.com/linux/security/advisories/2006_64_kernel.htmlhttp://www.redhat.com/support/errata/RHSA-2006-0617.htmlhttp://www.redhat.com/support/errata/RHSA-2006-0710.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0012.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0013.htmlhttp://www.securityfocus.com/archive/1/444887/100/0/threadedhttp://www.securityfocus.com/bid/18847http://www.ubuntu.com/usn/usn-331-1http://www.ubuntu.com/usn/usn-346-1http://www.vupen.com/english/advisories/2006/2680https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=197670https://exchange.xforce.ibmcloud.com/vulnerabilities/27579https://issues.rpath.com/browse/RPL-611https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10886http://bugzilla.kernel.org/show_bug.cgi?id=2966http://secunia.com/advisories/21179http://secunia.com/advisories/21298http://secunia.com/advisories/21498http://secunia.com/advisories/21605http://secunia.com/advisories/21614http://secunia.com/advisories/21695http://secunia.com/advisories/21934http://secunia.com/advisories/22082http://secunia.com/advisories/22093http://secunia.com/advisories/22174http://secunia.com/advisories/22497http://secunia.com/advisories/22822http://secunia.com/advisories/23064http://secunia.com/advisories/23788http://secunia.com/advisories/24288http://support.avaya.com/elmodocs2/security/ASA-2006-203.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-254.htmhttp://support.avaya.com/elmodocs2/security/ASA-2007-078.htmhttp://www.debian.org/security/2006/dsa-1183http://www.debian.org/security/2006/dsa-1184http://www.mandriva.com/security/advisories?name=MDKSA-2006:150http://www.mandriva.com/security/advisories?name=MDKSA-2006:151http://www.novell.com/linux/security/advisories/2006_42_kernel.htmlhttp://www.novell.com/linux/security/advisories/2006_47_kernel.htmlhttp://www.novell.com/linux/security/advisories/2006_49_kernel.htmlhttp://www.novell.com/linux/security/advisories/2006_64_kernel.htmlhttp://www.redhat.com/support/errata/RHSA-2006-0617.htmlhttp://www.redhat.com/support/errata/RHSA-2006-0710.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0012.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0013.htmlhttp://www.securityfocus.com/archive/1/444887/100/0/threadedhttp://www.securityfocus.com/bid/18847http://www.ubuntu.com/usn/usn-331-1http://www.ubuntu.com/usn/usn-346-1http://www.vupen.com/english/advisories/2006/2680https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=197670https://exchange.xforce.ibmcloud.com/vulnerabilities/27579https://issues.rpath.com/browse/RPL-611https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10886
2006-07-05
Published