National Vulnerability Database (NVD) National Vulnerability Database (CVE-2008-1294)

National Cyber-Alert System

Vulnerability Summary for CVE-2008-1294

Original release date:05/02/2008

Last revised:08/21/2010

Source: US-CERT/NIST

Overview

Linux kernel 2.6.17, and other versions before 2.6.22, does not check when a user attempts to set RLIMIT_CPU to 0 until after the change is made, which allows local users to bypass intended resource limits.

Impact

CVSS Severity (version 2.0):

CVSS v2 Base Score:2.1 (LOW) (AV:L/AC:L/Au:N/C:N/I:N/A:P) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 3.9

CVSS Version 2 Metrics:

Access Vector: Locally exploitable

Access Complexity: Low

Authentication: Not required to exploit

Impact Type:Allows disruption of serviceUnknown

Vendor Statements (disclaimer)

Official Statement from Red Hat (01/15/2009)

This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 2.1, 3, 4, and Red Hat Enterprise MRG. It was addressed in Red Hat Enterprise Linux 5 via: https://rhn.redhat.com/errata/RHSA-2008-0612.html

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: UBUNTU

Name: USN-618-1

Hyperlink:http://www.ubuntu.com/usn/usn-618-1

External Source: BID

Name: 29004

Hyperlink:http://www.securityfocus.com/bid/29004

External Source: REDHAT

Name: RHSA-2008:0612

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0612.html

External Source: DEBIAN

Name: DSA-1565

Hyperlink:http://www.debian.org/security/2008/dsa-1565

External Source: SECUNIA

Name: 31341

Hyperlink:http://secunia.com/advisories/31341

External Source: SECUNIA

Name: 30769

Hyperlink:http://secunia.com/advisories/30769

External Source: SECUNIA

Name: 30018

Hyperlink:http://secunia.com/advisories/30018

External Source: OVAL

Name: oval:org.mitre.oval:def:10974

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10974

External Source: MISC

Name: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=9926e4c74300c4b31dee007298c6475d33369df0

Hyperlink:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=9926e4c74300c4b31dee007298c6475d33369df0

External Source: CONFIRM

Name: http://bugs.gentoo.org/show_bug.cgi?id=215000

Hyperlink:http://bugs.gentoo.org/show_bug.cgi?id=215000

External Source: XF

Name: linux-kernel-rlimitcpu-security-bypass(42145)

Hyperlink:http://xforce.iss.net/xforce/xfdb/42145

External Source: CONFIRM

Name: http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22

Hyperlink:http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22

References to Check Content

Identifier:oval:org.mitre.oval:def:10974

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10974

Vulnerable software and versions

Configuration 1

* cpe:/o:linux:linux_kernel:2.6.16

* cpe:/o:linux:linux_kernel:2.6.16.1

* cpe:/o:linux:linux_kernel:2.6.16.10

* cpe:/o:linux:linux_kernel:2.6.16.11

* cpe:/o:linux:linux_kernel:2.6.16.12

* cpe:/o:linux:linux_kernel:2.6.16.13

* cpe:/o:linux:linux_kernel:2.6.16.14

* cpe:/o:linux:linux_kernel:2.6.16.15

* cpe:/o:linux:linux_kernel:2.6.16.16

* cpe:/o:linux:linux_kernel:2.6.16.17

* cpe:/o:linux:linux_kernel:2.6.16.18

* cpe:/o:linux:linux_kernel:2.6.16.19

* cpe:/o:linux:linux_kernel:2.6.16.2

* cpe:/o:linux:linux_kernel:2.6.16.20

* cpe:/o:linux:linux_kernel:2.6.16.21

* cpe:/o:linux:linux_kernel:2.6.16.22

* cpe:/o:linux:linux_kernel:2.6.16.23

* cpe:/o:linux:linux_kernel:2.6.16.24

* cpe:/o:linux:linux_kernel:2.6.16.25

* cpe:/o:linux:linux_kernel:2.6.16.26

* cpe:/o:linux:linux_kernel:2.6.16.27

* cpe:/o:linux:linux_kernel:2.6.16.28

* cpe:/o:linux:linux_kernel:2.6.16.29

* cpe:/o:linux:linux_kernel:2.6.16.3

* cpe:/o:linux:linux_kernel:2.6.16.30

* cpe:/o:linux:linux_kernel:2.6.16.31

* cpe:/o:linux:linux_kernel:2.6.16.32

* cpe:/o:linux:linux_kernel:2.6.16.33

* cpe:/o:linux:linux_kernel:2.6.16.34

* cpe:/o:linux:linux_kernel:2.6.16.35

* cpe:/o:linux:linux_kernel:2.6.16.36

* cpe:/o:linux:linux_kernel:2.6.16.37

* cpe:/o:linux:linux_kernel:2.6.16.38

* cpe:/o:linux:linux_kernel:2.6.16.39

* cpe:/o:linux:linux_kernel:2.6.16.4

* cpe:/o:linux:linux_kernel:2.6.16.40

* cpe:/o:linux:linux_kernel:2.6.16.41

* cpe:/o:linux:linux_kernel:2.6.16.43

* cpe:/o:linux:linux_kernel:2.6.16.44

* cpe:/o:linux:linux_kernel:2.6.16.45

* cpe:/o:linux:linux_kernel:2.6.16.46

* cpe:/o:linux:linux_kernel:2.6.16.47

* cpe:/o:linux:linux_kernel:2.6.16.48

* cpe:/o:linux:linux_kernel:2.6.16.49

* cpe:/o:linux:linux_kernel:2.6.16.5

* cpe:/o:linux:linux_kernel:2.6.16.50

* cpe:/o:linux:linux_kernel:2.6.16.51

* cpe:/o:linux:linux_kernel:2.6.16.52

* cpe:/o:linux:linux_kernel:2.6.16.53

* cpe:/o:linux:linux_kernel:2.6.16.6

* cpe:/o:linux:linux_kernel:2.6.16.7

* cpe:/o:linux:linux_kernel:2.6.16.8

* cpe:/o:linux:linux_kernel:2.6.16.9

* cpe:/o:linux:linux_kernel:2.6.16:rc1

* cpe:/o:linux:linux_kernel:2.6.16:rc2

* cpe:/o:linux:linux_kernel:2.6.16:rc3

* cpe:/o:linux:linux_kernel:2.6.16:rc4

* cpe:/o:linux:linux_kernel:2.6.16:rc5

* cpe:/o:linux:linux_kernel:2.6.16:rc6

* cpe:/o:linux:linux_kernel:2.6.16_rc7

* cpe:/o:linux:linux_kernel:2.6.17

* cpe:/o:linux:linux_kernel:2.6.17.1

* cpe:/o:linux:linux_kernel:2.6.17.10

* cpe:/o:linux:linux_kernel:2.6.17.11

* cpe:/o:linux:linux_kernel:2.6.17.12

* cpe:/o:linux:linux_kernel:2.6.17.13

* cpe:/o:linux:linux_kernel:2.6.17.14

* cpe:/o:linux:linux_kernel:2.6.17.2

* cpe:/o:linux:linux_kernel:2.6.17.3

* cpe:/o:linux:linux_kernel:2.6.17.4

* cpe:/o:linux:linux_kernel:2.6.17.5

* cpe:/o:linux:linux_kernel:2.6.17.6

* cpe:/o:linux:linux_kernel:2.6.17.7

* cpe:/o:linux:linux_kernel:2.6.17.8

* cpe:/o:linux:linux_kernel:2.6.17.9

* cpe:/o:linux:linux_kernel:2.6.17:rc1

* cpe:/o:linux:linux_kernel:2.6.17:rc2

* cpe:/o:linux:linux_kernel:2.6.17:rc3

* cpe:/o:linux:linux_kernel:2.6.17:rc4

* cpe:/o:linux:linux_kernel:2.6.17:rc5

* cpe:/o:linux:linux_kernel:2.6.17:rc6

* cpe:/o:linux:linux_kernel:2.6.18

* cpe:/o:linux:linux_kernel:2.6.18.1

* cpe:/o:linux:linux_kernel:2.6.18.2

* cpe:/o:linux:linux_kernel:2.6.18.3

* cpe:/o:linux:linux_kernel:2.6.18.4

* cpe:/o:linux:linux_kernel:2.6.18.5

* cpe:/o:linux:linux_kernel:2.6.18.6

* cpe:/o:linux:linux_kernel:2.6.18.7

* cpe:/o:linux:linux_kernel:2.6.18.8

* cpe:/o:linux:linux_kernel:2.6.18:rc1

* cpe:/o:linux:linux_kernel:2.6.18:rc2

* cpe:/o:linux:linux_kernel:2.6.18:rc3

* cpe:/o:linux:linux_kernel:2.6.18:rc4

* cpe:/o:linux:linux_kernel:2.6.18:rc5

* cpe:/o:linux:linux_kernel:2.6.18:rc6

* cpe:/o:linux:linux_kernel:2.6.18:rc7

* cpe:/o:linux:linux_kernel:2.6.19.0

* cpe:/o:linux:linux_kernel:2.6.19.1

* cpe:/o:linux:linux_kernel:2.6.19.2

* cpe:/o:linux:linux_kernel:2.6.19.3

* cpe:/o:linux:linux_kernel:2.6.19:rc1

* cpe:/o:linux:linux_kernel:2.6.19:rc2

* cpe:/o:linux:linux_kernel:2.6.19:rc3

* cpe:/o:linux:linux_kernel:2.6.19:rc4

* cpe:/o:linux:linux_kernel:2.6.2

* cpe:/o:linux:linux_kernel:2.6.2:rc1

* cpe:/o:linux:linux_kernel:2.6.2:rc2

* cpe:/o:linux:linux_kernel:2.6.2:rc3

* cpe:/o:linux:linux_kernel:2.6.20

* cpe:/o:linux:linux_kernel:2.6.20.1

* cpe:/o:linux:linux_kernel:2.6.20.10

* cpe:/o:linux:linux_kernel:2.6.20.11

* cpe:/o:linux:linux_kernel:2.6.20.12

* cpe:/o:linux:linux_kernel:2.6.20.13

* cpe:/o:linux:linux_kernel:2.6.20.14

* cpe:/o:linux:linux_kernel:2.6.20.15

* cpe:/o:linux:linux_kernel:2.6.20.2

* cpe:/o:linux:linux_kernel:2.6.20.3

* cpe:/o:linux:linux_kernel:2.6.20.4

* cpe:/o:linux:linux_kernel:2.6.20.5

* cpe:/o:linux:linux_kernel:2.6.20.6

* cpe:/o:linux:linux_kernel:2.6.20.7

* cpe:/o:linux:linux_kernel:2.6.20.8

* cpe:/o:linux:linux_kernel:2.6.20.9

* cpe:/o:linux:linux_kernel:2.6.20:rc2

* cpe:/o:linux:linux_kernel:2.6.21

* cpe:/o:linux:linux_kernel:2.6.21.1

* cpe:/o:linux:linux_kernel:2.6.21.2

* cpe:/o:linux:linux_kernel:2.6.21.3

* cpe:/o:linux:linux_kernel:2.6.21.4

* cpe:/o:linux:linux_kernel:2.6.21:git1

* cpe:/o:linux:linux_kernel:2.6.21:git2

* cpe:/o:linux:linux_kernel:2.6.21:git3

* cpe:/o:linux:linux_kernel:2.6.21:git4

* cpe:/o:linux:linux_kernel:2.6.21:git5

* cpe:/o:linux:linux_kernel:2.6.21:git6

* cpe:/o:linux:linux_kernel:2.6.21:git7

* cpe:/o:linux:linux_kernel:2.6.21:rc3

* cpe:/o:linux:linux_kernel:2.6.21:rc4

* cpe:/o:linux:linux_kernel:2.6.21:rc5

* cpe:/o:linux:linux_kernel:2.6.21:rc6

* cpe:/o:linux:linux_kernel:2.6.21:rc7 and previous versions

* Denotes Vulnerable Software

Technical Details

Vulnerability Type (View All)

Resource Management Errors (CWE-399)
Input Validation (CWE-20)

CVE Standard Vulnerability Entry:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1294