CVE-2007-0006
Current Description
The key serial number collision avoidance code in the key_alloc_serial function in Linux kernel 2.6.9 up to 2.6.20 allows local users to cause a denial of service (crash) via vectors that trigger a null dereference, as originally reported as "spinlock CPU recursion."
Evaluator Description
The scheme for selecting serial numbers was changed from incrementing a counter to random number selection, increasing the likelihood of a serial number collision.
Basic Data
Published | February 06, 2007 |
---|---|
Last Modified | October 11, 2017 |
Assigner | cve@mitre.org |
Data Type | CVE |
Data Format | MITRE |
Data Version | 4.0 |
Problem Type | NVD-CWE-Other |
CVE Data Version | 4.0 |
Base Metric V2
CVSS 2 - Version | 2.0 |
---|---|
CVSS 2 - Vector String | AV:L/AC:M/Au:N/C:N/I:N/A:P |
CVSS 2 - Access Vector | LOCAL |
CVSS 2 - Access Complexity | MEDIUM |
CVSS 2 - Authentication | NONE |
CVSS 2 - Confidentiality Impact | NONE |
CVSS 2 - Availability Impact | PARTIAL |
CVSS 2 - Base Score | 1.9 |
Severity | LOW |
Exploitability Score | 3.4 |
Impact Score | 2.9 |
Obtain All Privilege | false |
Obtain User Privilege | false |
Obtain Other Privilege | false |
Base Metric V3
No data provided.
Configurations
-
OR - Configuration 1
Cpe Version Part Vendor Product Version Update Edition Language SW Edition Target SW Target HW Other Version Start Including Version End Including Version Start Excluding Version End Excluding 2.3 OS Linux Linux Kernel 2.6.9 2.6.20 * * * * * *