CVE-2007-1865
published 2007-09-18CVE-2007-1865: The ipv6_getsockopt_sticky function in the kernel in Red Hat Enterprise Linux (RHEL) Beta 5.1.0 allows local users to obtain sensitive information (kernel…
PriorityP44low1.9CVSS 2.0
AVLACMAuNCPINAN
EPSS
0.32%
23.8th percentile
The ipv6_getsockopt_sticky function in the kernel in Red Hat Enterprise Linux (RHEL) Beta 5.1.0 allows local users to obtain sensitive information (kernel memory contents) via a negative value of the len parameter. NOTE: this issue has been disputed in a bug comment, stating that "len is ignored when copying header info to the user's buffer.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2007-1865 ipv6_getsockopt_sticky copy_to_user leak
bugzilla·2007-05-04·CVSS 1.9
CVE-2007-1865 [LOW] CVE-2007-1865 ipv6_getsockopt_sticky copy_to_user leak
CVE-2007-1865 ipv6_getsockopt_sticky copy_to_user leak
A user can supply len < 0 in ipv6_getsockopt_sticky and cause a leak of kernel
memory. The len value is returned and then later used in do_ipv6_getsockopt().
Bugzilla
CVE-2007-1865 ipv6_getsockopt_sticky copy_to_user leak
bugzilla·2007-03-13·CVSS 1.9
CVE-2007-1865 [LOW] CVE-2007-1865 ipv6_getsockopt_sticky copy_to_user leak
CVE-2007-1865 ipv6_getsockopt_sticky copy_to_user leak
A user can supply len < 0 in ipv6_getsockopt_sticky and cause a leak of kernel
memory.
Discussion:
Created attachment 149966
Upstream patch from Chris Wright
---
Hi Marcel -
This patch doesn't appear to be needed - len is ignored when copying header info
to the user's buffer in ipv6_getsockopt_sticky() -- the length to hand back to
userspace is taken direclty from the header.
I don't see this patch upstream. Let me know if I've missed the vulnerablity
here.
---
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release. Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update
2007-09-18
Published