CVE-2006-4342
published 2006-10-17CVE-2006-4342: The kernel in Red Hat Enterprise Linux 3, when running on SMP systems, allows local users to cause a denial of service (deadlock) by running the shmat function…
PriorityP414medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.39%
31.2th percentile
The kernel in Red Hat Enterprise Linux 3, when running on SMP systems, allows local users to cause a denial of service (deadlock) by running the shmat function on an shm at the same time that shmctl is removing that shm (IPC_RMID), which prevents a spinlock from being unlocked.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.0MEDIUMAV:L/AC:H/Au:N/C:N/I:N/A:C
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
security flaw
vendor_redhat·2006-10-13·CVSS 5.5
CVE-2006-4342 [MEDIUM] security flaw
security flaw
The kernel in Red Hat Enterprise Linux 3, when running on SMP systems, allows local users to cause a denial of service (deadlock) by running the shmat function on an shm at the same time that shmctl is removing that shm (IPC_RMID), which prevents a spinlock from being unlocked.
GHSA
GHSA-876r-chc7-85m3: The kernel in Red Hat Enterprise Linux 3, when running on SMP systems, allows local users to cause a denial of service (deadlock) by running the shmat
ghsa_unreviewed·2022-05-01
CVE-2006-4342 [MEDIUM] CWE-667 GHSA-876r-chc7-85m3: The kernel in Red Hat Enterprise Linux 3, when running on SMP systems, allows local users to cause a denial of service (deadlock) by running the shmat
The kernel in Red Hat Enterprise Linux 3, when running on SMP systems, allows local users to cause a denial of service (deadlock) by running the shmat function on an shm at the same time that shmctl is removing that shm (IPC_RMID), which prevents a spinlock from being unlocked.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2006-4342 security flaw
bugzilla·2018-08-16·CVSS 5.5
CVE-2006-4342 [MEDIUM] CVE-2006-4342 security flaw
CVE-2006-4342 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
The kernel in Red Hat Enterprise Linux 3, when running on SMP systems, allows local users to cause a denial of service (deadlock) by running the shmat function on an shm at the same time that shmctl is removing that shm (IPC_RMID), which prevents a spinlock from being unlocked.
Bugzilla
CVE-2006-4342 shmat hangs by simultaneous shmctl(IPC_RMID)
bugzilla·2006-09-07·CVSS 5.5
CVE-2006-4342 [MEDIUM] CVE-2006-4342 shmat hangs by simultaneous shmctl(IPC_RMID)
CVE-2006-4342 shmat hangs by simultaneous shmctl(IPC_RMID)
Escalated to Bugzilla from IssueTracker
Discussion:
Created attachment 135788
Proposed Patch
---
Created attachment 136333
Proposed Patch
Added write locks around kfree to resolve a memory corruption issue.
---
Created attachment 136605
Proposed Patch
moved br_write_lock and unlock to ipc_unlock_deleted
---
Deadlock happens on smp machines when a shmat() function runs at the same time
that shmctl() is used to remove the same shm. While the shmat process waits at
the spinlock in ipc_lock function, the shmctl function deletes the path to the
kern_ipc_perm structure which holds the spinlock variable and frees the memory
location. Because of this, the ipc_unlock() run for shmctl() does not unlock the
spinlock and the shmat w
CWE
Deadlock
mitre_cwe·CVSS 2.1
[LOW] CWE-833 Deadlock
CWE-833: Deadlock
The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Availability. Impact: DoS: Resource Consumption (CPU), DoS: Resource Consumption (Other), DoS: Crash, Exit, or Restart. Each thread of execution will "hang" and prevent tasks from completing. In some cases, CPU consumption may occur if a lock check occurs in a tight loop.
Detection Methods:
Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done
CWE
Improper Locking
mitre_cwe
CWE-667 Improper Locking
CWE-667: Improper Locking
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
Locking is a type of synchronization behavior that ensures that multiple independently-operating processes or threads do not interfere with each other when accessing the same resource. All processes/threads are expected to follow the same steps for locking. If these steps are not followed precisely - or if no locking is done at all - then another process/thread could modify the shared resource in a way that is not visible or predictable to the original process. This can lead to data or memory corruption, denial of service, etc.
Modes of Introduction:
Phase: Architecture and Design
Phase: Implementation
Common Consequences:
Scope: A
http://secunia.com/advisories/22497http://secunia.com/advisories/23064http://support.avaya.com/elmodocs2/security/ASA-2006-254.htmhttp://www.kb.cert.org/vuls/id/245984http://www.redhat.com/support/errata/RHSA-2006-0710.htmlhttps://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=205618https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9649http://secunia.com/advisories/22497http://secunia.com/advisories/23064http://support.avaya.com/elmodocs2/security/ASA-2006-254.htmhttp://www.kb.cert.org/vuls/id/245984http://www.redhat.com/support/errata/RHSA-2006-0710.htmlhttps://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=205618https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9649
2006-10-17
Published