Description
A numeric casting discrepancy in sdla_xfer in Linux kernel 2.6.x up to 2.6.5 and 2.4 up to 2.4.29-rc1 allows local users to read portions of kernel memory via a large len argument, which is received as an int but cast to a short, which prevents a read loop from filling a buffer.
References (8)
Core 8
Core References
Various Sources vendor-advisory
x_refsource_mandriva
http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2006:044
Various Sources mailing-list
x_refsource_mlist
http://www.uwsg.iu.edu/hypermail/linux/kernel/0404.2/0743.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/18977
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/19369
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2006/dsa-1018
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/16759
Exploit mailing-list
x_refsource_mlist
http://www.uwsg.iu.edu/hypermail/linux/kernel/0404.2/0313.html
Vendor Advisory vendor-advisory
x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDKSA-2006:072
Scores
EPSS
0.0046
EPSS Percentile
37.8%
Details
Status
published
Products (16)
linux/linux_kernel
2.4.0 test1 (12 CPE variants)
linux/linux_kernel
2.4.18 (9 CPE variants)
linux/linux_kernel
2.4.19 pre1 (6 CPE variants)
linux/linux_kernel
2.4.21 pre1 (3 CPE variants)
linux/linux_kernel
2.4.22 pre10
linux/linux_kernel
2.4.23 (2 CPE variants)
linux/linux_kernel
2.4.23_ow2
linux/linux_kernel
2.4.24
linux/linux_kernel
2.4.24_ow1
linux/linux_kernel
2.4.25
... and 6 more
Published
Dec 31, 2004
Tracked Since
Feb 18, 2026