CVE-2004-2536
The exit_thread function (process.c) in Linux kernel 2.6 through 2.6.5 does not invalidate the per-TSS io_bitmap pointers if a process obtains IO access permissions from the ioperm function but does not drop those permissions when it exits, which allows…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.34%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The exit_thread function (process.c) in Linux kernel 2.6 through 2.6.5 does not invalidate the per-TSS io_bitmap pointers if a process obtains IO access permissions from the ioperm function but does not drop those permissions when it exits, which allows other processes to access the per-TSS pointers, access restricted memory locations, and possibly gain privileges.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 2.34% probability · 83th percentile
- CISA KEV
- Not listed
- Affected
- linux/linux kernel
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/11577Vendor Advisory
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.6
- http://www.osvdb.org/5997
- http://www.securityfocus.com/bid/10302
- http://www.ussg.iu.edu/hypermail/linux/kernel/0405.0/1242.htmlExploit, Patch
- http://www.ussg.iu.edu/hypermail/linux/kernel/0405.0/1265.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16106
- http://secunia.com/advisories/11577Vendor Advisory
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.6
- http://www.osvdb.org/5997
- http://www.securityfocus.com/bid/10302
- http://www.ussg.iu.edu/hypermail/linux/kernel/0405.0/1242.htmlExploit, Patch
- http://www.ussg.iu.edu/hypermail/linux/kernel/0405.0/1265.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16106
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.