CVE-2007-3105

CVSS V2 Medium 4.6 CVSS V3 None
Description
Stack-based buffer overflow in the random number generator (RNG) implementation in the Linux kernel before 2.6.22 might allow local root users to cause a denial of service or gain privileges by setting the default wakeup threshold to a value greater than the output pool size, which triggers writing random numbers to the stack by the pool transfer function involving "bound check ordering". NOTE: this issue might only cross privilege boundaries in environments that have granular assignment of privileges for root.
Overview
  • CVE ID
  • CVE-2007-3105
  • Assigner
  • secalert@redhat.com
  • Vulnerability Status
  • Modified
  • Published Version
  • 2007-07-27T21:30:00
  • Last Modified Date
  • 2023-02-13T02:17:55
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 1 OR 2.6.22
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:L/AC:L/Au:N/C:P/I:P/A:P
  • Access Vector
  • LOCAL
  • Access Compatibility
  • LOW
  • Authentication
  • NONE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • PARTIAL
  • Base Score
  • 4.6
  • Severity
  • MEDIUM
  • Exploitability Score
  • 3.9
  • Impact Score
  • 6.4
References
Reference URL Reference Tags
http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.22-git14.log
https://issues.rpath.com/browse/RPL-1650
http://support.avaya.com/elmodocs2/security/ASA-2007-474.htm
http://www.debian.org/security/2007/dsa-1363
http://www.mandriva.com/security/advisories?name=MDKSA-2007:196
http://www.mandriva.com/security/advisories?name=MDKSA-2007:195
http://www.mandriva.com/security/advisories?name=MDKSA-2007:216
http://www.redhat.com/support/errata/RHSA-2007-0940.html
http://www.redhat.com/support/errata/RHSA-2007-0939.html
http://www.novell.com/linux/security/advisories/2007_51_kernel.html
http://www.novell.com/linux/security/advisories/2007_53_kernel.html
http://www.ubuntu.com/usn/usn-510-1
http://www.ubuntu.com/usn/usn-508-1
http://www.ubuntu.com/usn/usn-509-1
http://www.securityfocus.com/bid/25348
http://secunia.com/advisories/26500 Vendor Advisory
http://secunia.com/advisories/26647 Vendor Advisory
http://secunia.com/advisories/26643 Vendor Advisory
http://secunia.com/advisories/26651 Vendor Advisory
http://secunia.com/advisories/27322 Vendor Advisory
http://secunia.com/advisories/27436 Vendor Advisory
http://secunia.com/advisories/26664 Vendor Advisory
http://secunia.com/advisories/27212 Vendor Advisory
http://secunia.com/advisories/27227 Vendor Advisory
http://secunia.com/advisories/27747 Vendor Advisory
http://www.debian.org/security/2008/dsa-1504
http://secunia.com/advisories/29058 Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10371
History
Created Old Value New Value Data Type Notes
2022-05-10 18:58:12 Added to TrackCVE
2023-02-13 03:02:07 2023-02-13T02:17:55 CVE Modified Date updated
2023-02-13 03:02:07 Stack-based buffer overflow in the random number generator (RNG) implementation in the Linux kernel before 2.6.22 might allow local root users to cause a denial of service or gain privileges by setting the default wakeup threshold to a value greater than the output pool size, which triggers writing random numbers to the stack by the pool transfer function involving "bound check ordering". NOTE: this issue might only cross privilege boundaries in environments that have granular assignment of privileges for root. Stack-based buffer overflow in the random number generator (RNG) implementation in the Linux kernel before 2.6.22 might allow local root users to cause a denial of service or gain privileges by setting the default wakeup threshold to a value greater than the output pool size, which triggers writing random numbers to the stack by the pool transfer function involving "bound check ordering". NOTE: this issue might only cross privilege boundaries in environments that have granular assignment of privileges for root. Description updated