linux kernel mremap privilege escalation updated since 05.01.2004
Published:		02.03.2004
Source:		BUGTRAQ
SecurityVulns ID:		3344
Type:		local
Level:		9/10
Description:		It's possible to map memory page of zero size causing memory corruption in kernel.

Affected:		LINUX : kernel 2.2
		LINUX : kernel 2.4
		LINUX : kernel 2.6

Original document		Paul Starzetz, mremap(2) full details available (02.03.2004)
		Paul Starzetz, [Full-Disclosure] Second critical mremap() bug found in all Linux kernels (18.02.2004)
		Paul Starzetz, [Full-Disclosure] Linux kernel mremap vulnerability (05.01.2004)

Files:		Linux kernel do_mremap() proof-of-concept exploit code
		Linux kernel mremap() bound checking bug exploit
		Proof-of-concept exploit code for do_mremap() #2
		mremap missing do_munmap return check kernel exploit
Discuss:		Read or add your comments to this news (0 comments)