#VU99727 Loop with unreachable exit condition ('infinite loop') in Linux kernel - CVE-2005-2973
Vulnerability identifier: #VU99727
Vulnerability risk: Low
CVSSv4.0: 1.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Clear]
CVE-ID:
CWE-ID:
CWE-835
Exploitation vector: Local
Exploit availability: Yes
Vulnerable software:
Linux kernel
Operating systems & Components /
Operating system
Vendor: Linux Foundation
Description
The vulnerability allows a local user to perform service disruption.
The udp_v6_get_port function in udp.c in Linux 2.6 before 2.6.14-rc5, when running IPv6, allows local users to cause a denial of service (infinite loop and crash).
Mitigation
Install update from vendor's repository.
Vulnerable software versions
Linux kernel: All versions
External links
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=170772
https://www.securityfocus.com/advisories/9549
https://www.securityfocus.com/advisories/9555
https://www.securityfocus.com/bid/15156
https://www.securityfocus.com/advisories/9806
https://secunia.com/advisories/17917
https://secunia.com/advisories/17918
https://secunia.com/advisories/17261
https://www.redhat.com/support/errata/RHSA-2006-0140.html
https://secunia.com/advisories/18562
https://www.redhat.com/support/errata/RHSA-2006-0190.html
https://www.redhat.com/support/errata/RHSA-2006-0191.html
https://secunia.com/advisories/18684
https://www.debian.org/security/2006/dsa-1017
https://secunia.com/advisories/17280
https://www.debian.org/security/2006/dsa-1018
https://secunia.com/advisories/19374
https://secunia.com/advisories/19369
https://www.osvdb.org/20163
https://secunia.com/advisories/19185
https://www.redhat.com/support/errata/RHSA-2006-0493.html
https://secunia.com/advisories/20237
https://support.avaya.com/elmodocs2/security/ASA-2006-161.htm
https://secunia.com/advisories/21745
https://www.mandriva.com/security/advisories?name=MDKSA-2006:040
https://www.mandriva.com/security/advisories?name=MDKSA-2006:072
https://www.vupen.com/english/advisories/2005/2173
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10041
https://usn.ubuntu.com/219-1/
https://www.securityfocus.com/archive/1/428058/100/0/threaded
https://www.securityfocus.com/archive/1/428028/100/0/threaded
https://www.securityfocus.com/archive/1/427980/100/0/threaded
https://www.securityfocus.com/archive/1/419522/100/0/threaded
https://linux.bkbits.net:8080/linux-2.6/cset%404342df67SNhRx_3FGhUrrU-FXLlQIA
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
