CVE-2005-2709

Linux Kernel < 2.6.14 - Denial of Service via sysctl Interface File Handling

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2005-2709. PoCs published by Rémi Denis-Courmont.

AI-analyzed exploit summary This exploit triggers a local denial-of-service vulnerability in the Linux kernel (CVE-2005-2973) by exhausting IPv6 UDP ports, causing an infinite loop in port selection. It spawns multiple processes to bypass file descriptor limits and force the kernel into a crash condition.

Description

The sysctl functionality (sysctl.c) in Linux kernel before 2.6.14.1 allows local users to cause a denial of service (kernel oops) and possibly execute code by opening an interface file in /proc/sys/net/ipv4/conf/, waiting until the interface is unregistered, then obtaining and modifying function pointers in memory that was used for the ctl_table.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Rémi Denis-Courmont · cdoslinux

https://www.exploit-db.com/exploits/26489

View Code ZIP pw:eip

This exploit triggers a local denial-of-service vulnerability in the Linux kernel (CVE-2005-2973) by exhausting IPv6 UDP ports, causing an infinite loop in port selection. It spawns multiple processes to bypass file descriptor limits and force the kernel into a crash condition.

Classification

Working Poc 95%

Attack Type

Dos

Complexity

Moderate

Reliability

Reliable

Target: Linux Kernel < 2.6.14 with IPv6

No auth needed

Prerequisites: Local access to the system · IPv6 enabled · Kernel version < 2.6.14

MITRE ATT&CK

T1499 - Endpoint Denial of Service

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (27)

Core 27

Core References

Vendor Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2005/2359

Vendor Advisory vendor-advisory x_refsource_ubuntu

https://usn.ubuntu.com/219-1/

Vendor Advisory vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDKSA-2006:059

Vendor Advisory x_refsource_confirm

http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.14.1

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2006-0140.html

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/18684

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/19369

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2006-0101.html

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/17541

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2006/dsa-1018

Third Party Advisory, VDB Entry vendor-advisory x_refsource_fedora

http://www.securityfocus.com/archive/1/428058/100/0/threaded

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://securitytracker.com/id?1015434

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://www.osvdb.org/20676

Third Party Advisory, VDB Entry vendor-advisory x_refsource_fedora

http://www.securityfocus.com/archive/1/427981/100/0/threaded

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/17648

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2006-0190.html

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/18510

Third Party Advisory, VDB Entry vendor-advisory x_refsource_fedora

http://www.securityfocus.com/archive/1/428028/100/0/threaded

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/23040

Third Party Advisory, VDB Entry vendor-advisory x_refsource_fedora

http://www.securityfocus.com/archive/1/427980/100/0/threaded

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2006/dsa-1017

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10746

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/17504

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/19374

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2006-0191.html

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/18562

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/15365

Scores

EPSS 0.0099

EPSS Percentile 58.0%

Details

CWE

CWE-399

Status published

Products (28)

linux/linux_kernel 2.2.27

linux/linux_kernel 2.4.1

linux/linux_kernel 2.4.2

linux/linux_kernel 2.4.3

linux/linux_kernel 2.4.4

linux/linux_kernel 2.4.5

linux/linux_kernel 2.4.6

linux/linux_kernel 2.4.7

linux/linux_kernel 2.4.8

linux/linux_kernel 2.4.9

... and 18 more

Published Nov 20, 2005

Tracked Since Feb 18, 2026