CVE-2007-3105
Bound check ordering issue in random driver
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Stack-based buffer overflow in the random number generator (RNG) implementation in the Linux kernel before 2.6.22 might allow local root users to cause a denial of service or gain privileges by setting the default wakeup threshold to a value greater than the output pool size, which triggers writing random numbers to the stack by the pool transfer function involving "bound check ordering". NOTE: this issue might only cross privilege boundaries in environments that have granular assignment of privileges for root.
Desbordamiento de búfer basado en pila en la implementación del generador de números aleatorios (RNG) en el kernel de Linux versiones anteriores a 2.6.22 podría permitir a usuarios root locales provocar una denegación de servicio o obtener privilegios al asignar valor al umbral por defecto del despertado (wakeup) a un valor mayor que el tamaño de la cola de salida, que dispara la escritura de números aleatorios a la pila por la función de transferencia de cola involucrando "comprobación de límites de ordenación".
NOTA: Esta vulnerabilidad podría solamente cruzar límites de privilegios en entornos que tienen asignación granular de privilegios para root.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2007-06-07 CVE Reserved
- 2007-07-27 CVE Published
- 2024-08-07 CVE Updated
- 2024-09-21 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (30)
| URL | Tag | Source |
|---|---|---|
| http://support.avaya.com/elmodocs2/security/ASA-2007-474.htm | X_refsource_confirm | |
| http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.22-git14.log | X_refsource_confirm | |
| http://www.securityfocus.com/bid/25348 | Vdb Entry | |
| https://issues.rpath.com/browse/RPL-1650 | X_refsource_confirm | |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10371 | Signature |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | <= 2.6.22 Search vendor "Linux" for product "Linux Kernel" and version " <= 2.6.22" | - |
Affected
| ||||||