vulnwire
7.2high

CVE-2004-00772 exploits

The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the retu…

Published 22 y ago · modified 4 mo ago · JSON

CVSS
7.2
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.5%
percentile 84%
Public exploits
2
Exploit-DB

The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985.

Exploit prediction (EPSS)

2.45% probability of exploitation in the next 30 days, higher than 84% of all scored CVEs.

Exploits and detections

  • EDB-160 Linux Kernel 2.2.25/2.4.24/2.6.2 - 'mremap()' Local Privilege Escalation · local · 2004-03-01
  • EDB-154 Linux Kernel 2.2.25/2.4.24/2.6.2 - 'mremap()' Validator · local · 2004-02-18

CVSS scores

Assigned byVersionScoreVector
NVD2.07.2AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Technology feeds
Linux kernel (RSS, critical only)

References

  • slackware.com /security/viewer.php?l=slackware-security&y=2004&m=slackware-security.404734 · vendor-advisory, x_refsource_SLACKWARE, x_transferred
  • debian.org /security/2004/dsa-450 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • debian.org /security/2004/dsa-440 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • redhat.com /support/errata/RHSA-2004-069.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • ciac.org /ciac/bulletins/o-082.shtml · third-party-advisory, government-resource, x_refsource_CIAC, x_transferred
  • fedoranews.org /updates/FEDORA-2004-079.shtml · vendor-advisory, x_refsource_FEDORA, x_transferred
  • debian.org /security/2004/dsa-439 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • debian.org /security/2004/dsa-475 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • distro.conectiva.com.br /atualizacoes/?id=a&anuncio=000820 · vendor-advisory, x_refsource_CONECTIVA, x_transferred
  • redhat.com /support/errata/RHSA-2004-106.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • novell.com /linux/security/advisories/2004_05_linux_kernel.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • debian.org /security/2004/dsa-442 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • redhat.com /support/errata/RHSA-2004-065.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • debian.org /security/2004/dsa-470 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • frontal2.mandriva.com /security/advisories?name=MDKSA-2004:015 · vendor-advisory, x_refsource_MANDRAKE, x_transferred
  • securityfocus.com /bid/9686 · vdb-entry, x_refsource_BID, x_transferred
  • debian.org /security/2004/dsa-438 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • debian.org /security/2004/dsa-514 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • isec.pl /vulnerabilities/isec-0014-mremap-unmap.txt · x_refsource_MISC, x_transferred
  • debian.org /security/2004/dsa-456 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A837 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • security.gentoo.org /glsa/glsa-200403-02.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
  • debian.org /security/2004/dsa-441 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • archives.neohapsis.com /archives/vulnwatch/2004-q1/0040.html · mailing-list, x_refsource_VULNWATCH, x_transferred
  • debian.org /security/2004/dsa-454 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/15244 · vdb-entry, x_refsource_XF, x_transferred
  • marc.info /?l=bugtraq&m=107711762014175&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • debian.org /security/2004/dsa-444 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • redhat.com /support/errata/RHSA-2004-066.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • marc.info /?l=bugtraq&m=107755871932680&w=2 · vendor-advisory, x_refsource_TRUSTIX, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A825 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • debian.org /security/2004/dsa-453 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • osvdb.org /3986 · vdb-entry, x_refsource_OSVDB, x_transferred
  • kb.cert.org /vuls/id/981222 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • debian.org /security/2004/dsa-466 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • marc.info /?l=bugtraq&m=107712137732553&w=2 · vendor-advisory, x_refsource_TRUSTIX, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.