CVE-2004-0077

Linux <2.2.25, <2.4.24, <2.6.2 - Privilege Escalation

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2004-0077. PoCs published by Paul Starzetz, Christophe Devine.

AI-analyzed exploit summary This exploit targets a Linux kernel vulnerability (CVE-2004-0077) in the mremap system call, allowing local privilege escalation by manipulating page table entries to execute arbitrary code in the context of a setuid binary.

Description

The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Paul Starzetz · clocallinux

https://www.exploit-db.com/exploits/160

View Code ZIP pw:eip

This exploit targets a Linux kernel vulnerability (CVE-2004-0077) in the mremap system call, allowing local privilege escalation by manipulating page table entries to execute arbitrary code in the context of a setuid binary.

Classification

Working Poc 95%

Attack Type

Lpe

Complexity

Complex

Reliability

Racy

Target: Linux kernel versions <= 2.2.25, <= 2.4.24, and <= 2.6.2

No auth needed

Prerequisites: Local access to the system · Presence of a setuid binary (default: /bin/ping)

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 16, 2026 Full analysis →

exploitdb WORKING POC VERIFIED

by Christophe Devine · clocallinux

https://www.exploit-db.com/exploits/154

View Code ZIP pw:eip

This exploit tests the vulnerability in the Linux kernel's do_mremap() function (CVE-2004-0077) by repeatedly mapping memory regions and attempting to mremap them to overlapping addresses. It demonstrates the potential for local privilege escalation due to improper bounds checking.

Classification

Working Poc 90%

Attack Type

Lpe

Complexity

Moderate

Reliability

Racy

Target: Linux kernel (versions before 2.4.25 and 2.6.3)

No auth needed

Prerequisites: Local access to the target system · Kernel version vulnerable to CVE-2004-0077

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (36)

Core 36

Core References

Mailing List vendor-advisory x_refsource_fedora

http://fedoranews.org/updates/FEDORA-2004-079.shtml

Vendor Advisory vendor-advisory x_refsource_slackware

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.404734

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2004/dsa-450

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2004/dsa-440

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2004-069.html

Third Party Advisory, US Government Resource third-party-advisory government-resource x_refsource_ciac

http://www.ciac.org/ciac/bulletins/o-082.shtml

Patch, Vendor Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2004/dsa-439

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2004/dsa-475

Vendor Advisory vendor-advisory x_refsource_conectiva

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000820

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2004-106.html

Vendor Advisory vendor-advisory x_refsource_suse

http://www.novell.com/linux/security/advisories/2004_05_linux_kernel.html

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2004/dsa-442

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2004-065.html

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2004/dsa-470

Various Sources vendor-advisory x_refsource_mandrake

http://frontal2.mandriva.com/security/advisories?name=MDKSA-2004:015

Exploit, Patch, Vendor Advisory vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/9686

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2004/dsa-438

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2004/dsa-514

Various Sources x_refsource_misc

http://isec.pl/vulnerabilities/isec-0014-mremap-unmap.txt

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2004/dsa-456

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A837

Patch, Vendor Advisory vendor-advisory x_refsource_gentoo

http://security.gentoo.org/glsa/glsa-200403-02.xml

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2004/dsa-441

Third Party Advisory mailing-list x_refsource_vulnwatch

http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0040.html

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2004/dsa-454

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/15244

Mailing List mailing-list x_refsource_bugtraq

http://marc.info/?l=bugtraq&m=107711762014175&w=2

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2004/dsa-444

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2004-066.html

Mailing List vendor-advisory x_refsource_trustix

http://marc.info/?l=bugtraq&m=107755871932680&w=2

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A825

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2004/dsa-453

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://www.osvdb.org/3986

US Government Resource third-party-advisory x_refsource_cert-vn

http://www.kb.cert.org/vuls/id/981222

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2004/dsa-466

Mailing List vendor-advisory x_refsource_trustix

http://marc.info/?l=bugtraq&m=107712137732553&w=2

Scores

EPSS 0.0243

EPSS Percentile 82.1%

Details

Status published

Products (36)

linux/linux_kernel 2.2.0

linux/linux_kernel 2.2.1

linux/linux_kernel 2.2.2

linux/linux_kernel 2.2.3

linux/linux_kernel 2.2.4

linux/linux_kernel 2.2.5

linux/linux_kernel 2.2.6

linux/linux_kernel 2.2.7

linux/linux_kernel 2.2.8

linux/linux_kernel 2.2.9

... and 26 more

Published Mar 03, 2004

Tracked Since Feb 18, 2026