| Vulnerability Name: | CVE-2004-0114 (CCN-15061) | ||||||||
| Assigned: | 2004-02-05 | ||||||||
| Published: | 2004-02-05 | ||||||||
| Updated: | 2017-10-10 | ||||||||
| Summary: | The shmat system call in the System V Shared Memory interface for FreeBSD 5.2 and earlier, NetBSD 1.3 and earlier, and OpenBSD 2.6 and earlier, does not properly decrement a shared memory segment's reference count when the vm_map_find function fails, which could allow local users to gain read or write access to a portion of kernel memory and gain privileges. | ||||||||
| CVSS v3 Severity: | 5.9 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||
| CVSS v2 Severity: | 4.6 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||
| Vulnerability Type: | CWE-Other | ||||||||
| Vulnerability Consequences: | Gain Privileges | ||||||||
| References: | Source: CCN Type: FreeBSD Security Advisory FreeBSD-SA-04:02.shmat shmat reference counting bug Source: FREEBSD Type: Patch, Vendor Advisory FreeBSD-SA-04:02 Source: NETBSD Type: UNKNOWN NetBSD-SA2004-004 Source: CCN Type: BugTraq Mailing List, Thu Feb 05 2004 - 12:08:39 CST reference count overflow in shmat() Source: MITRE Type: CNA CVE-2004-0114 Source: CCN Type: NetBSD Security Advisory 2004-004 shmat reference counting bug Source: BUGTRAQ Type: UNKNOWN 20040205 [PINE-CERT-20040201] reference count overflow in shmat() Source: CCN Type: OpenBSD 3.4 errata Web site 010: SECURITY FIX: February 5, 2004 Source: CCN Type: OpenBSD 3.3 errata Web site 015: SECURITY FIX: February 5, 2004 Source: CONFIRM Type: UNKNOWN http://www.openbsd.org/errata33.html#sysvshm Source: OSVDB Type: UNKNOWN 3836 Source: CCN Type: OSVDB ID: 3836 Multiple BSD shmat() Privilege Escalation Source: MISC Type: UNKNOWN http://www.pine.nl/press/pine-cert-20040201.txt Source: BID Type: Patch, Vendor Advisory 9586 Source: CCN Type: BID-9586 BSD Kernel SHMAT System Call Privilege Escalation Vulnerability Source: XF Type: UNKNOWN bsd-shmat-gain-privileges(15061) Source: XF Type: UNKNOWN bsd-shmat-gain-privileges(15061) | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||