Vulnerabilidad en Linux kernel. Denegación de servicio y obtención de privilegios (CVE-2006-2451)
Gravedad CVSS v2.0:
MEDIA
Tipo:
CWE-399
Error en la gestión de recursos
Fecha de publicación:
07/07/2006
Última modificación:
03/04/2025
Descripción
El soporte suid_dumpable de Linux kernel 2.6.13 hasta versiones anteriores a 2.6.17.4, y 2.6.16 anterior a 2.6.16.24, permite a usuarios locales provocar una denegación de servicio (agotamiento de disco) y posiblemente obtener privilegios a través del argumento PR_SET_DUMPABLE de la función prctl y un programa que provoca que se cree un fichero de volcado de memoria (core dump) en un directorio en el que el usuario no tiene permisos.
Impacto
Puntuación base 2.0
4.60
Gravedad 2.0
MEDIA
Productos y versiones vulnerables
| CPE | Desde | Hasta |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:2.6.13:*:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:2.6.13.1:*:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:2.6.13.2:*:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:2.6.13.3:*:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:2.6.13.4:*:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:2.6.13.5:*:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:2.6.14:*:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:2.6.14:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:2.6.14:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:2.6.14:rc3:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:2.6.14:rc4:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:2.6.14:rc5:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:2.6.14.1:*:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:2.6.14.2:*:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:2.6.14.3:*:*:*:*:*:*:* |
Para consultar la lista completa de nombres de CPE con productos y versiones, ver esta página
Referencias a soluciones, herramientas e información
- http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=195902
- http://secunia.com/advisories/20953
- http://secunia.com/advisories/20960
- http://secunia.com/advisories/20965
- http://secunia.com/advisories/20986
- http://secunia.com/advisories/20991
- http://secunia.com/advisories/21179
- http://secunia.com/advisories/21498
- http://secunia.com/advisories/21966
- http://securitytracker.com/id?1016451=
- http://support.avaya.com/elmodocs2/security/ASA-2006-162.htm
- http://www.kernel.org/git/?p=linux/kernel/git/stable/linux-2.6.17.y.git%3Ba%3Dcommit%3Bh%3D0af184bb9f80edfbb94de46cb52e9592e5a547b0
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.24
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.17.4
- http://www.novell.com/linux/security/advisories/2006_16_sr.html
- http://www.novell.com/linux/security/advisories/2006_17_sr.html
- http://www.novell.com/linux/security/advisories/2006_42_kernel.html
- http://www.novell.com/linux/security/advisories/2006_47_kernel.html
- http://www.novell.com/linux/security/advisories/2006_49_kernel.html
- http://www.osvdb.org/27030
- http://www.redhat.com/support/errata/RHSA-2006-0574.html
- http://www.securityfocus.com/archive/1/439483/100/100/threaded
- http://www.securityfocus.com/archive/1/439610/100/100/threaded
- http://www.securityfocus.com/archive/1/439869/100/0/threaded
- http://www.securityfocus.com/archive/1/440057/100/0/threaded
- http://www.securityfocus.com/archive/1/440117/100/0/threaded
- http://www.securityfocus.com/archive/1/440118/100/0/threaded
- http://www.securityfocus.com/archive/1/440379/100/0/threaded
- http://www.securityfocus.com/bid/18874
- http://www.ubuntu.com/usn/usn-311-1
- http://www.vupen.com/english/advisories/2006/2699
- https://issues.rpath.com/browse/RPL-488
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11336
- http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=195902
- http://secunia.com/advisories/20953
- http://secunia.com/advisories/20960
- http://secunia.com/advisories/20965
- http://secunia.com/advisories/20986
- http://secunia.com/advisories/20991
- http://secunia.com/advisories/21179
- http://secunia.com/advisories/21498
- http://secunia.com/advisories/21966
- http://securitytracker.com/id?1016451=
- http://support.avaya.com/elmodocs2/security/ASA-2006-162.htm
- http://www.kernel.org/git/?p=linux/kernel/git/stable/linux-2.6.17.y.git%3Ba%3Dcommit%3Bh%3D0af184bb9f80edfbb94de46cb52e9592e5a547b0
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.24
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.17.4
- http://www.novell.com/linux/security/advisories/2006_16_sr.html
- http://www.novell.com/linux/security/advisories/2006_17_sr.html
- http://www.novell.com/linux/security/advisories/2006_42_kernel.html
- http://www.novell.com/linux/security/advisories/2006_47_kernel.html
- http://www.novell.com/linux/security/advisories/2006_49_kernel.html
- http://www.osvdb.org/27030
- http://www.redhat.com/support/errata/RHSA-2006-0574.html
- http://www.securityfocus.com/archive/1/439483/100/100/threaded
- http://www.securityfocus.com/archive/1/439610/100/100/threaded
- http://www.securityfocus.com/archive/1/439869/100/0/threaded
- http://www.securityfocus.com/archive/1/440057/100/0/threaded
- http://www.securityfocus.com/archive/1/440117/100/0/threaded
- http://www.securityfocus.com/archive/1/440118/100/0/threaded
- http://www.securityfocus.com/archive/1/440379/100/0/threaded
- http://www.securityfocus.com/bid/18874
- http://www.ubuntu.com/usn/usn-311-1
- http://www.vupen.com/english/advisories/2006/2699
- https://issues.rpath.com/browse/RPL-488
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11336