CVE-2006-4997
published 2006-10-10CVE-2006-4997: The clip_mkip function in net/atm/clip.c of the ATM subsystem in Linux kernel allows remote attackers to cause a denial of service (panic) via unknown vectors…
PriorityP430high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
4.72%
90.8th percentile
The clip_mkip function in net/atm/clip.c of the ATM subsystem in Linux kernel allows remote attackers to cause a denial of service (panic) via unknown vectors that cause the ATM subsystem to access the memory of socket buffers after they are freed (freed pointer dereference).
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| linux | linux_kernel | < 2.6.18 | 2.6.18 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.07.1HIGHAV:N/AC:M/Au:N/C:N/I:N/A:C
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2006-12-14·CVSS 7.5
CVE-2006-5619 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Linux kernel vulnerabilities
Mark Dowd discovered that the netfilter iptables module did not
correcly handle fragmented packets. By sending specially crafted
packets, a remote attacker could exploit this to bypass firewall
rules. This has only be fixed for Ubuntu 6.10; the corresponding fix
for Ubuntu 5.10 and 6.06 will follow soon. (CVE-2006-4572)
Dmitriy Monakhov discovered an information leak in the
__block_prepare_write() function. During error recovery, this function
did not properly clear memory buffers which could allow local users to
read portions of unlinked files. This only affects Ubuntu 5.10.
(CVE-2006-4813)
ADLab Venustech Info Ltd discovered that the ATM network driver
referenced an already released pointer in some circumstance
Red Hat
security flaw
vendor_redhat·2006-09-12·CVSS 7.5
CVE-2006-4997 [HIGH] security flaw
security flaw
The clip_mkip function in net/atm/clip.c of the ATM subsystem in Linux kernel allows remote attackers to cause a denial of service (panic) via unknown vectors that cause the ATM subsystem to access the memory of socket buffers after they are freed (freed pointer dereference).
GHSA
GHSA-684x-5684-48r7: The clip_mkip function in net/atm/clip
ghsa_unreviewed·2022-05-01
CVE-2006-4997 [HIGH] CWE-416 GHSA-684x-5684-48r7: The clip_mkip function in net/atm/clip
The clip_mkip function in net/atm/clip.c of the ATM subsystem in Linux kernel allows remote attackers to cause a denial of service (panic) via unknown vectors that cause the ATM subsystem to access the memory of socket buffers after they are freed (freed pointer dereference).
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2006-4997 security flaw
bugzilla·2018-08-16·CVSS 7.5
CVE-2006-4997 [HIGH] CVE-2006-4997 security flaw
CVE-2006-4997 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
The clip_mkip function in net/atm/clip.c of the ATM subsystem in Linux kernel allows remote attackers to cause a denial of service (panic) via unknown vectors that cause the ATM subsystem to access the memory of socket buffers after they are freed (freed pointer dereference).
Bugzilla
CVE-2006-4997 IP over ATM clip_mkip dereference freed pointer
bugzilla·2006-09-20·CVSS 7.5
CVE-2006-4997 [HIGH] CVE-2006-4997 IP over ATM clip_mkip dereference freed pointer
CVE-2006-4997 IP over ATM clip_mkip dereference freed pointer
Reported by ADLab, Venustech info Ltd CHINA:
There is a vulnerability in function clip_mkip() in net/atm/clip.c. When
re-processing received data, a struct sk_buff pointer skb may be dereferenced
after a free operation. It will lead to a kernel panic and denying further service.
clip_mkip (clip.c):
502 while ((skb = skb_dequeue(©)) != NULL)
503 if (!clip_devs) {
504 atm_return(vcc,skb->truesize);
505 kfree_skb(skb);
506 }
507 else {
508 unsigned int len = skb->len;
509
510 clip_push(vcc,skb);
511 PRIV(skb->dev)->stats.rx_packets--;
512 PRIV(skb->dev)->stats.rx_bytes -= len;
513 }
At line 511, PRIV(skb->dev) reference skb->dev; but after call clip_push at line
510, skb may be freed.
clip_push (clip.c):
198 static void clip
Bugzilla
CVE-2006-4997 IP over ATM clip_mkip dereference freed pointer
bugzilla·2006-09-20·CVSS 7.5
CVE-2006-4997 [HIGH] CVE-2006-4997 IP over ATM clip_mkip dereference freed pointer
CVE-2006-4997 IP over ATM clip_mkip dereference freed pointer
Reported by ADLab, Venustech info Ltd CHINA:
There is a vulnerability in function clip_mkip() in net/atm/clip.c. When
re-processing received data, a struct sk_buff pointer skb may be dereferenced
after a free operation. It will lead to a kernel panic and denying further service.
clip_mkip (clip.c):
502 while ((skb = skb_dequeue(©)) != NULL)
503 if (!clip_devs) {
504 atm_return(vcc,skb->truesize);
505 kfree_skb(skb);
506 }
507 else {
508 unsigned int len = skb->len;
509
510 clip_push(vcc,skb);
511 PRIV(skb->dev)->stats.rx_packets--;
512 PRIV(skb->dev)->stats.rx_bytes -= len;
513 }
At line 511, PRIV(skb->dev) reference skb->dev; but after call clip_push at line
510, skb may be freed.
clip_push (clip.c):
198 static void clip
Bugzilla
CVE-2006-4997 IP over ATM clip_mkip dereference freed pointer
bugzilla·2006-09-13·CVSS 7.5
CVE-2006-4997 [HIGH] CVE-2006-4997 IP over ATM clip_mkip dereference freed pointer
CVE-2006-4997 IP over ATM clip_mkip dereference freed pointer
Reported by ADLab, Venustech info Ltd CHINA:
There is a vulnerability in function clip_mkip() in net/atm/clip.c. When
re-processing received data, a struct sk_buff pointer skb may be dereferenced
after a free operation. It will lead to a kernel panic and denying further service.
clip_mkip (clip.c):
502 while ((skb = skb_dequeue(©)) != NULL)
503 if (!clip_devs) {
504 atm_return(vcc,skb->truesize);
505 kfree_skb(skb);
506 }
507 else {
508 unsigned int len = skb->len;
509
510 clip_push(vcc,skb);
511 PRIV(skb->dev)->stats.rx_packets--;
512 PRIV(skb->dev)->stats.rx_bytes -= len;
513 }
At line 511, PRIV(skb->dev) reference skb->dev; but after call clip_push at line
510, skb may be freed.
clip_push (clip.c):
198 static void clip
Bugzilla
CVE-2006-4997 IP over ATM clip_mkip dereference freed pointer
bugzilla·2006-09-13·CVSS 7.5
CVE-2006-4997 [HIGH] CVE-2006-4997 IP over ATM clip_mkip dereference freed pointer
CVE-2006-4997 IP over ATM clip_mkip dereference freed pointer
Reported by ADLab, Venustech info Ltd CHINA:
There is a vulnerability in function clip_mkip() in net/atm/clip.c. When
re-processing received data, a struct sk_buff pointer skb may be dereferenced
after a free operation. It will lead to a kernel panic and denying further service.
clip_mkip (clip.c):
502 while ((skb = skb_dequeue(©)) != NULL)
503 if (!clip_devs) {
504 atm_return(vcc,skb->truesize);
505 kfree_skb(skb);
506 }
507 else {
508 unsigned int len = skb->len;
509
510 clip_push(vcc,skb);
511 PRIV(skb->dev)->stats.rx_packets--;
512 PRIV(skb->dev)->stats.rx_bytes -= len;
513 }
At line 511, PRIV(skb->dev) reference skb->dev; but after call clip_push at line
510, skb may be freed.
clip_push (clip.c):
198 static void clip
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=206265http://secunia.com/advisories/22253http://secunia.com/advisories/22279http://secunia.com/advisories/22292http://secunia.com/advisories/22497http://secunia.com/advisories/22762http://secunia.com/advisories/22945http://secunia.com/advisories/23064http://secunia.com/advisories/23370http://secunia.com/advisories/23384http://secunia.com/advisories/23395http://secunia.com/advisories/23474http://secunia.com/advisories/23752http://secunia.com/advisories/23788http://secunia.com/advisories/24288http://secunia.com/advisories/25691http://securitytracker.com/id?1017526http://support.avaya.com/elmodocs2/security/ASA-2006-249.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-254.htmhttp://support.avaya.com/elmodocs2/security/ASA-2007-078.htmhttp://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fe26109a9dfd9327fdbe630fc819e1b7450986b2http://www.mandriva.com/security/advisories?name=MDKSA-2006:197http://www.mandriva.com/security/advisories?name=MDKSA-2007:012http://www.mandriva.com/security/advisories?name=MDKSA-2007:025http://www.novell.com/linux/security/advisories/2006_79_kernel.htmlhttp://www.redhat.com/support/errata/RHSA-2006-0689.htmlhttp://www.redhat.com/support/errata/RHSA-2006-0710.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0012.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0013.htmlhttp://www.securityfocus.com/archive/1/471457http://www.securityfocus.com/bid/20363http://www.ubuntu.com/usn/usn-395-1http://www.us.debian.org/security/2006/dsa-1233http://www.us.debian.org/security/2006/dsa-1237http://www.vupen.com/english/advisories/2006/3937http://www.vupen.com/english/advisories/2006/3999https://exchange.xforce.ibmcloud.com/vulnerabilities/29387https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10388http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=206265http://secunia.com/advisories/22253http://secunia.com/advisories/22279http://secunia.com/advisories/22292http://secunia.com/advisories/22497http://secunia.com/advisories/22762http://secunia.com/advisories/22945http://secunia.com/advisories/23064http://secunia.com/advisories/23370http://secunia.com/advisories/23384http://secunia.com/advisories/23395http://secunia.com/advisories/23474http://secunia.com/advisories/23752http://secunia.com/advisories/23788http://secunia.com/advisories/24288http://secunia.com/advisories/25691http://securitytracker.com/id?1017526http://support.avaya.com/elmodocs2/security/ASA-2006-249.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-254.htmhttp://support.avaya.com/elmodocs2/security/ASA-2007-078.htmhttp://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fe26109a9dfd9327fdbe630fc819e1b7450986b2http://www.mandriva.com/security/advisories?name=MDKSA-2006:197http://www.mandriva.com/security/advisories?name=MDKSA-2007:012http://www.mandriva.com/security/advisories?name=MDKSA-2007:025http://www.novell.com/linux/security/advisories/2006_79_kernel.htmlhttp://www.redhat.com/support/errata/RHSA-2006-0689.htmlhttp://www.redhat.com/support/errata/RHSA-2006-0710.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0012.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0013.htmlhttp://www.securityfocus.com/archive/1/471457http://www.securityfocus.com/bid/20363http://www.ubuntu.com/usn/usn-395-1http://www.us.debian.org/security/2006/dsa-1233http://www.us.debian.org/security/2006/dsa-1237http://www.vupen.com/english/advisories/2006/3937http://www.vupen.com/english/advisories/2006/3999https://exchange.xforce.ibmcloud.com/vulnerabilities/29387https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10388
2006-10-10
Published