Improper privilege management in Linux kernel - CVE-2002-1380
Published: December 23, 2002 / Updated: November 6, 2024
Vulnerability identifier: #VU99981
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Clear
CVE-ID: CVE-2002-1380
CWE-ID: CWE-269
Exploitation vector: Local access
Exploit availability:
Public exploit is available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to perform service disruption.
Linux kernel 2.2.x allows local users to cause a denial of service (crash) by using the mmap() function with a PROT_READ parameter to access non-readable memory pages through the /proc/pid/mem interface.
How to mitigate CVE-2002-1380
Install update from vendor's repository.
Sources
- http://www.debian.org/security/2003/dsa-336
- http://www.linuxsecurity.com/advisories/engarde_advisory-2976.html
- http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:039
- http://www.redhat.com/support/errata/RHSA-2003-088.html
- http://www.securityfocus.com/bid/6420
- http://www.trustix.net/errata/misc/2002/TSL-2002-0083-kernel.asc.txt
- https://exchange.xforce.ibmcloud.com/vulnerabilities/10884