// For flags

CVE-2004-0427

Debian Linux Security Advisory 1067-1

Severity Score

5.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The do_fork function in Linux 2.4.x before 2.4.26, and 2.6.x before 2.6.6, does not properly decrement the mm_count counter when an error occurs after the mm_struct for a child process has been activated, which triggers a memory leak that allows local users to cause a denial of service (memory exhaustion) via the clone (CLONE_VM) system call.

La función do_fork en Linux 2.4.x y 2.6.x no decrementa el contador mm_count cuando un error ocurre después de que se haya activado mm_struct de un proceso hijo, lo que dispara una fuga de memoria que permite a usarios locales causar una denegación de servicio (consumición de memoria).

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Local
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2004-04-29 CVE Reserved
  • 2004-04-30 CVE Published
  • 2024-08-08 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-401: Missing Release of Memory after Effective Lifetime
CAPEC
References (36)
URL Tag Source
http://linux.bkbits.net:8080/linux-2.4/cset%40407bf20eDeeejm8t36_tpvSE-8EFHA Broken Link
http://linux.bkbits.net:8080/linux-2.6/cset%40407b1217x4jtqEkpFW2g_-RcF0726A Broken Link
http://marc.info/?l=linux-kernel&m=108139073506983&w=2 Mailing List
http://secunia.com/advisories/11429 Broken Link
http://secunia.com/advisories/11464 Broken Link
http://secunia.com/advisories/11486 Broken Link
http://secunia.com/advisories/11541 Broken Link
http://secunia.com/advisories/11861 Broken Link
http://secunia.com/advisories/11891 Broken Link
http://secunia.com/advisories/11892 Broken Link
http://secunia.com/advisories/20162 Broken Link
http://secunia.com/advisories/20163 Broken Link
http://secunia.com/advisories/20202 Broken Link
http://secunia.com/advisories/20338 Third Party Advisory
http://www.ciac.org/ciac/bulletins/o-164.shtml Broken Link
http://www.securityfocus.com/bid/10221 Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/16002 Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10297 Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2819 Broken Link
URL Date SRC
URL Date SRC
ftp://patches.sgi.com/support/free/security/advisories/20040504-01-U.asc 2024-01-26
ftp://patches.sgi.com/support/free/security/advisories/20040505-01-U.asc 2024-01-26
URL Date SRC
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000846 2024-01-26
http://fedoranews.org/updates/FEDORA-2004-111.shtml 2024-01-26
http://security.gentoo.org/glsa/glsa-200407-02.xml 2024-01-26
http://www.debian.org/security/2006/dsa-1067 2024-01-26
http://www.debian.org/security/2006/dsa-1069 2024-01-26
http://www.debian.org/security/2006/dsa-1070 2024-01-26
http://www.debian.org/security/2006/dsa-1082 2024-01-26
http://www.mandriva.com/security/advisories?name=MDKSA-2004:037 2024-01-26
http://www.novell.com/linux/security/advisories/2004_10_kernel.html 2024-01-26
http://www.redhat.com/support/errata/RHSA-2004-255.html 2024-01-26
http://www.redhat.com/support/errata/RHSA-2004-260.html 2024-01-26
http://www.redhat.com/support/errata/RHSA-2004-327.html 2024-01-26
http://www.turbolinux.com/security/2004/TLSA-2004-14.txt 2024-01-26
https://access.redhat.com/security/cve/CVE-2004-0427 2004-08-18
https://bugzilla.redhat.com/show_bug.cgi?id=1617207 2004-08-18
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linux
Search vendor "Linux"
 Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
 >= 2.4.0 < 2.4.26
Search vendor "Linux" for product "Linux Kernel" and version " >= 2.4.0 < 2.4.26"
-
Affected
Linux
Search vendor "Linux"
 Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
 >= 2.6.0 < 2.6.6
Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.0 < 2.6.6"
-
Affected