CVE-2007-3739
published 2007-09-14CVE-2007-3739: mm/mmap.c in the hugetlb kernel, when run on PowerPC systems, does not prevent stack expansion from entering into reserved kernel page memory, which allows…
PriorityP411medium4.7CVSS 2.0
AVLACMAuNCNINAC
EPSS
0.38%
30.3th percentile
mm/mmap.c in the hugetlb kernel, when run on PowerPC systems, does not prevent stack expansion from entering into reserved kernel page memory, which allows local users to cause a denial of service (OOPS) via unspecified vectors.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv2.04.7MEDIUMAV:L/AC:M/Au:N/C:N/I:N/A:C
vendor_ubuntu4.9MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
linux-source-2.6.15, linux-source-2.6.17, linux-source-2.6.20 vulnerabilities
vendor_ubuntu·2007-09-25·CVSS 4.9
CVE-2007-3731 [MEDIUM] linux-source-2.6.15, linux-source-2.6.17, linux-source-2.6.20 vulnerabilities
Title: linux-source-2.6.15, linux-source-2.6.17, linux-source-2.6.20 vulnerabilities
Summary: linux-source-2.6.15, linux-source-2.6.17, linux-source-2.6.20 vulnerabilities
Evan Teran discovered that the Linux kernel ptrace routines did not
correctly handle certain requests robustly. Local attackers could exploit
this to crash the system, causing a denial of service. (CVE-2007-3731)
It was discovered that hugetlb kernels on PowerPC systems did not prevent
the stack from colliding with reserved kernel memory. Local attackers
could exploit this and crash the system, causing a denial of service.
(CVE-2007-3739)
It was discovered that certain CIFS filesystem actions did not honor
the umask of a process. Local attackers could exploit this to gain
additional privileges. (CVE-2007-3740)
Wojci
Red Hat
LTC36188-Don't allow the stack to grow into hugetlb reserved regions
vendor_redhat·2007-08-31·CVSS 4.7
CVE-2007-3739 [MEDIUM] LTC36188-Don't allow the stack to grow into hugetlb reserved regions
LTC36188-Don't allow the stack to grow into hugetlb reserved regions
mm/mmap.c in the hugetlb kernel, when run on PowerPC systems, does not prevent stack expansion from entering into reserved kernel page memory, which allows local users to cause a denial of service (OOPS) via unspecified vectors.
Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 2.1.
GHSA
GHSA-g9r8-mr7q-g5r2: mm/mmap
ghsa_unreviewed·2022-05-01
CVE-2007-3739 [MEDIUM] CWE-119 GHSA-g9r8-mr7q-g5r2: mm/mmap
mm/mmap.c in the hugetlb kernel, when run on PowerPC systems, does not prevent stack expansion from entering into reserved kernel page memory, which allows local users to cause a denial of service (OOPS) via unspecified vectors.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2007-3739 LTC36188-Don't allow the stack to grow into hugetlb reserved regions
bugzilla·2007-09-18·CVSS 4.7
CVE-2007-3739 [MEDIUM] CVE-2007-3739 LTC36188-Don't allow the stack to grow into hugetlb reserved regions
CVE-2007-3739 LTC36188-Don't allow the stack to grow into hugetlb reserved regions
From Adam Litke's mail to LKML (http://lkml.org/lkml/2007/1/29/180):
[PATCH] Don't allow the stack to grow into hugetlb reserved regions
When expanding the stack, we don't currently check if the VMA will cross
into an area of the address space that is reserved for hugetlb pages.
Subsequent faults on the expanded portion of such a VMA will confuse the
low-level MMU code, resulting in an OOPS. Check for this.
Discussion:
see bz#253313 for more details
---
This CVE also affects RHEL-3 (advisory has not been filled yet). On the
ppc there is in mm/mmap.c file function called "expand_stack" which has
the same function as that one mentioned in the patch. This also checks first,
if there is enough memory to a
Bugzilla
CVE-2007-3739 LTC36188-Don't allow the stack to grow into hugetlb reserved regions
bugzilla·2007-08-17·CVSS 4.7
CVE-2007-3739 [MEDIUM] CVE-2007-3739 LTC36188-Don't allow the stack to grow into hugetlb reserved regions
CVE-2007-3739 LTC36188-Don't allow the stack to grow into hugetlb reserved regions
From Adam Litke's mail to LKML (http://lkml.org/lkml/2007/1/29/180):
[PATCH] Don't allow the stack to grow into hugetlb reserved regions
When expanding the stack, we don't currently check if the VMA will cross
into an area of the address space that is reserved for hugetlb pages.
Subsequent faults on the expanded portion of such a VMA will confuse the
low-level MMU code, resulting in an OOPS. Check for this.
Discussion:
A patch for this issue has been included in build 2.6.18-8.1.10.
---
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the u
http://lkml.org/lkml/2007/1/29/180http://secunia.com/advisories/23955http://secunia.com/advisories/26760http://secunia.com/advisories/26955http://secunia.com/advisories/26978http://secunia.com/advisories/27436http://secunia.com/advisories/27747http://secunia.com/advisories/27913http://secunia.com/advisories/29058http://support.avaya.com/elmodocs2/security/ASA-2007-474.htmhttp://www.debian.org/security/2007/dsa-1378http://www.debian.org/security/2008/dsa-1504http://www.redhat.com/support/errata/RHSA-2007-0705.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0939.htmlhttp://www.redhat.com/support/errata/RHSA-2007-1049.htmlhttp://www.ubuntu.com/usn/usn-518-1https://bugzilla.redhat.com/show_bug.cgi?id=253313https://exchange.xforce.ibmcloud.com/vulnerabilities/36592https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11455http://lkml.org/lkml/2007/1/29/180http://secunia.com/advisories/23955http://secunia.com/advisories/26760http://secunia.com/advisories/26955http://secunia.com/advisories/26978http://secunia.com/advisories/27436http://secunia.com/advisories/27747http://secunia.com/advisories/27913http://secunia.com/advisories/29058http://support.avaya.com/elmodocs2/security/ASA-2007-474.htmhttp://www.debian.org/security/2007/dsa-1378http://www.debian.org/security/2008/dsa-1504http://www.redhat.com/support/errata/RHSA-2007-0705.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0939.htmlhttp://www.redhat.com/support/errata/RHSA-2007-1049.htmlhttp://www.ubuntu.com/usn/usn-518-1https://bugzilla.redhat.com/show_bug.cgi?id=253313https://exchange.xforce.ibmcloud.com/vulnerabilities/36592https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11455
2007-09-14
Published