CVE-2006-0039

Severity CVSS v4.0:

Pending analysis

Type:

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Publication date:

19/05/2006

Last modified:

13/02/2023

Description

Race condition in the do_add_counters function in netfilter for Linux kernel 2.6.16 allows local users with CAP_NET_ADMIN capabilities to read kernel memory by triggering the race condition in a way that produces a size value that is inconsistent with allocated memory, which leads to a buffer over-read in IPT_ENTRY_ITERATE.

Impact

Vector 2.0

AV:L/AC:H/Au:N/C:P/I:N/A:C CVSS v2.0 Severity and Metrics:

Base Score: 4.70 MEDIUM
Vector: AV:L/AC:H/Au:N/C:P/I:N/A:C

Attack Vector (AV): Local
Attack Complexity (AC): High
Authentication (Au): None
Confidentiality (C): Physical
Integrity (I): None
Availability (A): Complete