vulnwire
5.0med

CVE-2004-0177

The ext3 code in Linux 2.4.x before 2.4.26 does not properly initialize journal descriptor blocks, which causes an information leak in whic…

Published 22 y ago · modified 4 mo ago · JSON

CVSS
5.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.6%
percentile 85%
Public exploits
0
none known

The ext3 code in Linux 2.4.x before 2.4.26 does not properly initialize journal descriptor blocks, which causes an information leak in which in-memory data is written to the device for the ext3 file system, which allows privileged users to obtain portions of kernel memory by reading the raw device.

Exploit prediction (EPSS)

2.60% probability of exploitation in the next 30 days, higher than 85% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

Classification

Technology feeds
Linux kernel (RSS, critical only)

References

  • ciac.org /ciac/bulletins/o-127.shtml · third-party-advisory, government-resource, x_refsource_CIAC, x_transferred
  • marc.info /?l=bugtraq&m=108213675028441&w=2 · vendor-advisory, x_refsource_TRUSTIX, x_transferred
  • bugzilla.fedora.us /show_bug.cgi?id=2336 · vendor-advisory, x_refsource_FEDORA, x_transferred
  • debian.org /security/2004/dsa-482 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • debian.org /security/2004/dsa-495 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • debian.org /security/2004/dsa-479 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/15867 · vdb-entry, x_refsource_XF, x_transferred
  • debian.org /security/2004/dsa-480 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • securityfocus.com /bid/10152 · vdb-entry, x_refsource_BID, x_transferred
  • distro.conectiva.com.br /atualizacoes/?id=a&anuncio=000846 · vendor-advisory, x_refsource_CONECTIVA, x_transferred
  • debian.org /security/2004/dsa-489 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • debian.org /security/2004/dsa-481 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10556 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • redhat.com /support/errata/RHSA-2005-293.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • linuxsecurity.com /advisories/engarde_advisory-4285.html · vendor-advisory, x_refsource_ENGARDE, x_transferred
  • redhat.com /support/errata/RHSA-2004-505.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • ciac.org /ciac/bulletins/o-121.shtml · third-party-advisory, government-resource, x_refsource_CIAC, x_transferred
  • ciac.org /ciac/bulletins/o-126.shtml · third-party-advisory, government-resource, x_refsource_CIAC, x_transferred
  • redhat.com /support/errata/RHSA-2004-504.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • mandriva.com /security/advisories?name=MDKSA-2004:029 · vendor-advisory, x_refsource_MANDRAKE, x_transferred
  • security.gentoo.org /glsa/glsa-200407-02.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
  • rhn.redhat.com /errata/RHSA-2004-166.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • linux.bkbits.net /linux-2.4/cset%404056b368s6vpJbGWxDD_LhQNYQrdzQ · x_refsource_MISC, x_transferred
  • debian.org /security/2004/dsa-491 · vendor-advisory, x_refsource_DEBIAN, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.