Bug 142246

Summary: VUL-0: kernel: single zero byte overflow in sysctl write
Product: [openSUSE] SUSE LINUX 10.0 Reporter: Marcus Meissner <meissner>
Component: KernelAssignee: E-mail List <kernel-maintainers>
Status: RESOLVED WONTFIX QA Contact: E-mail List <qa-bugs>
Severity: Normal    
Priority: P5 - None CC: security-team
Version: Final   
Target Milestone: ---   
Hardware: Other   
OS: Other   
Whiteboard: CVE-2005-4618: CVSS v2 Base Score: 3.6 (AV:L/AC:L/Au:N/C:N/I:P/A:P)
Found By: Other Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Marcus Meissner 2006-01-10 09:35:53 UTC 
is public

CVE-2005-4618

Buffer overflow in sysctl in the Linux Kernel 2.6 before 2.6.15 allows
local users to cause a denial of service and possibly execute
arbitrary code via a long string, which causes sysctl to write a zero
byte outside the buffer.

(single zero byte overflow)

http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8febdd85adaa41fa1fc1cb31286210fc2cd3ed0c


since a user cannot write into /proc/sys entries usually it is not that problematic.
Comment 1 Chris L Mason 2006-01-20 21:01:54 UTC 
Marcus, give the /proc/sys/ restrictions, do you really feel we need this patch?
Comment 2 Marcus Meissner 2006-01-20 22:31:52 UTC 
You mean that no user has write access to files below /proc/sys/?

In this case we can leave this patch out.
Comment 3 Thomas Biege 2009-10-13 20:47:05 UTC 
CVE-2005-4618: CVSS v2 Base Score: 3.6 (AV:L/AC:L/Au:N/C:N/I:P/A:P)