Vulnerability Name:

CVE-2007-5966 (CCN-39072)

Assigned:2007-12-07
Published:2007-12-07
Updated:2023-02-13
Summary:Integer overflow in the hrtimer_start function in kernel/hrtimer.c in the Linux kernel before 2.6.23.10 allows local users to execute arbitrary code or cause a denial of service (panic) via a large relative timeout value.
Note: some of these details are obtained from third party information.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): High
CVSS v2 Severity:7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
5.3 Medium (Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
5.9 Medium (CCN CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:C)
4.3 Medium (CCN Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Complete
7.2 High (REDHAT CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
5.3 Medium (REDHAT Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-119
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2007-5966

Source: CCN
Type: Kernel.org Web site
hrtimers: avoid overflow for large relative timeouts (CVE-2007-5966)

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: RHSA-2008-0585
Important: kernel security and bug fix update

Source: CCN
Type: RHSA-2009-1193
Important: kernel security and bug fix update

Source: CCN
Type: RHSA-2010-0079
Important: kernel security and bug fix update

Source: CCN
Type: SA28105
Linux Kernel "hrtimer_start()" Integer Overflow Vulnerability

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: DEBIAN
Type: DSA-1436
linux-2.6 -- several vulnerabilities

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: BID-26880
Linux Kernel 'hrtimers' Local Denial of Service Vulnerability

Source: secalert@redhat.com
Type: Patch
secalert@redhat.com

Source: CCN
Type: USN-574-1
Linux kernel vulnerabilities

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: XF
Type: UNKNOWN
linux-kernel-hrtimerstart-integer-overflow(39072)

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Vulnerable Configuration:Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*
    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:5::client:*:*:*:*:*
    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/o:linux:linux_kernel:2.6.23:-:*:*:*:*:*:*
  • OR cpe:/o:linux:linux_kernel:2.6.23.1:*:*:*:*:*:*:*
  • OR cpe:/o:linux:linux_kernel:2.6.23.2:*:*:*:*:*:*:*
  • OR cpe:/o:linux:linux_kernel:2.6.23.3:*:*:*:*:*:*:*
  • OR cpe:/o:linux:linux_kernel:2.6.23.4:*:*:*:*:*:*:*
  • OR cpe:/o:linux:linux_kernel:2.6.23.5:*:*:*:*:*:*:*
  • OR cpe:/o:linux:linux_kernel:2.6.23:rc1:*:*:*:*:*:*
  • OR cpe:/o:linux:linux_kernel:2.6.23:rc2:*:*:*:*:*:*
  • OR cpe:/o:linux:linux_kernel:2.6.23.9:*:*:*:*:*:*:*
  • OR cpe:/o:linux:linux_kernel:2.6.23.6:*:*:*:*:*:*:*
  • OR cpe:/o:linux:linux_kernel:2.6.23.7:*:*:*:*:*:*:*
  • AND
  • cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2007.1:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:7.04:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:client:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:7.10:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2007.1::x86-64:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20075966
    V
    		CVE-2007-5966
    2015-11-16
    oval:org.mitre.oval:def:29154
    P
    		RHSA-2009:1193 -- kernel security and bug fix update (Important)
    2015-08-17
    oval:org.mitre.oval:def:17238
    P
    		USN-574-1 -- linux-source-2.6.17/20/22 vulnerabilities
    2014-06-30
    oval:org.mitre.oval:def:20546
    P
    		DSA-1436-1 linux-2.6 fai-kernels user-mode-linux - several vulnerabilities
    2014-06-23
    oval:org.mitre.oval:def:22751
    P
    		ELSA-2009:1193: kernel security and bug fix update (Important)
    2014-05-26
    oval:org.mitre.oval:def:8125
    V
    		VMware kernel integer overflow vulnerability in hrtimer_start function
    2014-01-20
    oval:org.mitre.oval:def:10774
    V
    		Integer overflow in the hrtimer_start function in kernel/hrtimer.c in the Linux kernel before 2.6.23.10 allows local users to execute arbitrary code or cause a denial of service (panic) via a large relative timeout value. NOTE: some of these details are obtained from third party information.
    2013-04-29
    oval:com.redhat.rhsa:def:20091193
    P
    		RHSA-2009:1193: kernel security and bug fix update (Important)
    2009-08-04
    oval:org.debian:def:1436
    V
    		several vulnerabilities
    2007-12-20
    BACK
    linux linux kernel 2.6.23
    linux linux kernel 2.6.23.1
    linux linux kernel 2.6.23.2
    linux linux kernel 2.6.23.3
    linux linux kernel 2.6.23.4
    linux linux kernel 2.6.23.5
    linux linux kernel 2.6.23 rc1
    linux linux kernel 2.6.23 rc2
    linux linux kernel 2.6.23.9
    linux linux kernel 2.6.23.6
    linux linux kernel 2.6.23.7
    redhat enterprise linux 4
    redhat linux advanced workstation 2.1
    redhat enterprise linux 5
    mandrakesoft mandrake linux 2007.1
    debian debian linux 4.0
    canonical ubuntu 7.04
    redhat enterprise linux 5
    canonical ubuntu 7.10
    mandrakesoft mandrake linux 2007.1