CVE-2006-5753
published 2007-01-30CVE-2006-5753: Unspecified vulnerability in the listxattr system call in Linux kernel, when a "bad inode" is present, allows local users to cause a denial of service (data…
PriorityP422high7.2CVSS 2.0
AVLACLAuNCCICAC
EPSS
0.38%
29.9th percentile
Unspecified vulnerability in the listxattr system call in Linux kernel, when a "bad inode" is present, allows local users to cause a denial of service (data corruption) and possibly gain privileges via unknown vectors.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux_kernel | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_desktop | — | — |
CVSS provenance
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vendor_ubuntu7.5HIGH
vendor_redhat7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2007-02-10·CVSS 7.5
CVE-2006-4572 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Linux kernel vulnerabilities
Mark Dowd discovered that the netfilter iptables module did not
correcly handle fragmented IPv6 packets. By sending specially crafted
packets, a remote attacker could exploit this to bypass firewall
rules. This has has already been fixed for Ubuntu 6.10 in USN-395-1;
this is the corresponding fix for Ubuntu 6.06.(CVE-2006-4572)
Doug Chapman discovered an improper lock handling in the mincore()
function. A local attacker could exploit this to cause an eternal hang
in the kernel, rendering the machine unusable. (CVE-2006-4814)
Al Viro reported that the ISDN PPP module did not initialize the reset
state timer. By sending specially crafted ISDN packets, a remote
attacker could exploit this to crash the kernel. (CVE-2
Red Hat
kernel listxattr syscall can corrupt user space programs
vendor_redhat·2007-01-03·CVSS 7.2
CVE-2006-5753 [HIGH] CWE-681 kernel listxattr syscall can corrupt user space programs
kernel listxattr syscall can corrupt user space programs
Unspecified vulnerability in the listxattr system call in Linux kernel, when a "bad inode" is present, allows local users to cause a denial of service (data corruption) and possibly gain privileges via unknown vectors.
Statement: Red Hat Enterprise Linux 2.1 is not vulnerable to this issue as it only affects x86_64 architectures.
Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch at release.
GHSA
GHSA-p2rv-pwrw-64p2: Unspecified vulnerability in the listxattr system call in Linux kernel, when a "bad inode" is present, allows local users to cause a denial of service
ghsa_unreviewed·2022-05-01
CVE-2006-5753 [HIGH] GHSA-p2rv-pwrw-64p2: Unspecified vulnerability in the listxattr system call in Linux kernel, when a "bad inode" is present, allows local users to cause a denial of service
Unspecified vulnerability in the listxattr system call in Linux kernel, when a "bad inode" is present, allows local users to cause a denial of service (data corruption) and possibly gain privileges via unknown vectors.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2006-5753 kernel listxattr syscall can corrupt user space programs
bugzilla·2007-09-26·CVSS 7.2
CVE-2006-5753 [HIGH] CVE-2006-5753 kernel listxattr syscall can corrupt user space programs
CVE-2006-5753 kernel listxattr syscall can corrupt user space programs
The listxattr syscall can corrupt user space under certain circumstances. The
problem seems to be related to signed/unsigned conversion during size promotion.
The function return_EIO returns an int but its used as a ssize_t with a
comparison to 0. This causes the range check to fail and copy_to_user copies way
too much.
This has been observed on iso9660 and squashfs on x86_64 machines.
Discussion:
Proposed upstream patch:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=be6aab0e9fa6d3c6d75aa1e38ac972d8b4ee82b8
Reference:
http://lkml.org/lkml/2007/1/3/150
Bugzilla
CVE-2006-5753 listxattr syscall can corrupt user space programs [rhel-4.4]
bugzilla·2006-12-22·CVSS 7.2
CVE-2006-5753 [HIGH] CVE-2006-5753 listxattr syscall can corrupt user space programs [rhel-4.4]
CVE-2006-5753 listxattr syscall can corrupt user space programs [rhel-4.4]
The listxattr syscall can corrupt user space under certain circumstances. The
problem seems to be related to signed/unsigned conversion during size promotion.
The function return_EIO returns an int but its used as a ssize_t with a
comparison to 0. This causes the range check to fail and copy_to_user copies way
too much.
The command line "fsfuzz iso9660" can easily reproduce this behavior.
The problem here is the bad_inode_ops, and how they're set up. isofs creates a
bad inode, which is fine, but then any op called from that inode is supposed to
return -EIO via this method:
static int return_EIO(void)
{
return -EIO;
}
#define EIO_ERROR_SSIZE ((void *) (return_EIO_ssize))
static struct inode_operations bad_inode
http://fedoranews.org/cms/node/2739http://fedoranews.org/cms/node/2740http://lkml.org/lkml/2007/1/3/150http://osvdb.org/33020http://secunia.com/advisories/23955http://secunia.com/advisories/23997http://secunia.com/advisories/24098http://secunia.com/advisories/24100http://secunia.com/advisories/24206http://secunia.com/advisories/24400http://secunia.com/advisories/24429http://secunia.com/advisories/24482http://secunia.com/advisories/24547http://secunia.com/advisories/25226http://secunia.com/advisories/25683http://secunia.com/advisories/25691http://secunia.com/advisories/25714http://secunia.com/advisories/29058http://support.avaya.com/elmodocs2/security/ASA-2007-063.htmhttp://www.debian.org/security/2007/dsa-1304http://www.debian.org/security/2008/dsa-1503http://www.mandriva.com/security/advisories?name=MDKSA-2007:040http://www.mandriva.com/security/advisories?name=MDKSA-2007:060http://www.novell.com/linux/security/advisories/2007_18_kernel.htmlhttp://www.novell.com/linux/security/advisories/2007_21_kernel.htmlhttp://www.novell.com/linux/security/advisories/2007_30_kernel.htmlhttp://www.novell.com/linux/security/advisories/2007_35_kernel.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0014.htmlhttp://www.securityfocus.com/archive/1/471457http://www.securityfocus.com/bid/22316http://www.ubuntu.com/usn/usn-416-1https://issues.rpath.com/browse/RPL-1106https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9371http://fedoranews.org/cms/node/2739http://fedoranews.org/cms/node/2740http://lkml.org/lkml/2007/1/3/150http://osvdb.org/33020http://secunia.com/advisories/23955http://secunia.com/advisories/23997http://secunia.com/advisories/24098http://secunia.com/advisories/24100http://secunia.com/advisories/24206http://secunia.com/advisories/24400http://secunia.com/advisories/24429http://secunia.com/advisories/24482http://secunia.com/advisories/24547http://secunia.com/advisories/25226http://secunia.com/advisories/25683http://secunia.com/advisories/25691http://secunia.com/advisories/25714http://secunia.com/advisories/29058http://support.avaya.com/elmodocs2/security/ASA-2007-063.htmhttp://www.debian.org/security/2007/dsa-1304http://www.debian.org/security/2008/dsa-1503http://www.mandriva.com/security/advisories?name=MDKSA-2007:040http://www.mandriva.com/security/advisories?name=MDKSA-2007:060http://www.novell.com/linux/security/advisories/2007_18_kernel.htmlhttp://www.novell.com/linux/security/advisories/2007_21_kernel.htmlhttp://www.novell.com/linux/security/advisories/2007_30_kernel.htmlhttp://www.novell.com/linux/security/advisories/2007_35_kernel.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0014.htmlhttp://www.securityfocus.com/archive/1/471457http://www.securityfocus.com/bid/22316http://www.ubuntu.com/usn/usn-416-1https://issues.rpath.com/browse/RPL-1106https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9371
2007-01-30
Published