CVE-2006-5757: Race Condition

Published Nov 6, 2006

Updated

Race condition in the findgetblockslow function in the ISO9660 filesystem in Linux 2.6.18 and possibly other versions allows local users to cause a denial of service (infinite loop) by mounting a crafted ISO9660 filesystem containing malformed data structures.

Affected Software

105 affected components

Linux Linux kernel=2.6.11-rc3

Linux Linux kernel=2.6.11

Linux Linux kernel=2.6.17.12

Linux Linux kernel=2.6.16.9

Linux Linux kernel=2.6.12-rc1

Linux Linux kernel=2.6.12-rc4

Linux Linux kernel=2.6.14-rc2

Linux Linux kernel=2.6.5

Linux Linux kernel=2.6.15.3

Linux Linux kernel=2.6.1

Linux Linux kernel=2.6.16-rc1

Linux Linux kernel=2.6.13

Linux Linux kernel=2.6.13.3

Linux Linux kernel=2.6.11.8

Linux Linux kernel=2.6.17.8

Linux Linux kernel=2.6.14.4

Linux Linux kernel=2.6.14

Linux Linux kernel=2.6.17.14

Linux Linux kernel=2.6.10

Linux Linux kernel=2.6.13-rc1

Linux Linux kernel=2.6.14.3

Linux Linux kernel=2.6.13-rc6

Linux Linux kernel=2.6.11.6

Linux Linux kernel=2.6.11.11

Linux Linux kernel=2.6.0-test5

Linux Linux kernel=2.6.16.13

Linux Linux kernel=2.6.3

Linux Linux kernel=2.6.13-rc7

Linux Linux kernel=2.6.0-test2

Linux Linux kernel=2.6.17.3

Linux Linux kernel=2.6.4

Linux Linux kernel=2.6_test9_cvs

Linux Linux kernel=2.6.15.1

Linux Linux kernel=2.6.11.5

Linux Linux kernel=2.6.7-rc1

Linux Linux kernel=2.6.16.1

Linux Linux kernel=2.6.18.1

Linux Linux kernel=2.6.2

Linux Linux kernel=2.6.14.5

Linux Linux kernel=2.6.13.2

Linux Linux kernel=2.6.12-rc5

Linux Linux kernel=2.6.8-rc1

Linux Linux kernel=2.6.0-test11

Linux Linux kernel=2.6.17.5

Linux Linux kernel=2.6.14-rc3

Linux Linux kernel=2.6.17

Linux Linux kernel=2.6.1-rc2

Linux Linux kernel=2.6.11-rc4

Linux Linux kernel=2.6.16.11

Linux Linux kernel=2.6.15-rc3

Linux Linux kernel=2.6.8

Linux Linux kernel=2.6.17.10

Linux Linux kernel=2.6.14.1

Linux Linux kernel=2.6.19-rc1

Linux Linux kernel=2.6.16.23

Linux Linux kernel=2.6.0-test1

Linux Linux kernel=2.6.12.5

Linux Linux kernel=2.6.0-test6

Linux Linux kernel=2.6.12.1

Linux Linux kernel=2.6.10-rc2

Linux Linux kernel=2.6.17.1

Linux Linux kernel=2.6.0-test4

Linux Linux kernel=2.6.13.4

Linux Linux kernel=2.6.12.2

Linux Linux kernel=2.6.14-rc1

Linux Linux kernel=2.6.16

Linux Linux kernel=2.6.0-test10

Linux Linux kernel=2.6.15.2

Linux Linux kernel=2.6.0-test9

Linux Linux kernel=2.6.17.11

Linux Linux kernel=2.6.12.4

Linux Linux kernel=2.6.12.3

Linux Linux kernel=2.6.13-rc4

Linux Linux kernel=2.6.7

Linux Linux kernel=2.6.11-rc2

Linux Linux kernel=2.6.15.4

Linux Linux kernel=2.6.1-rc1

Linux Linux kernel=2.6.16.12

Linux Linux kernel=2.6.6-rc1

Linux Linux kernel=2.6.9-2.6.20

Linux Linux kernel=2.6.16.27

Linux Linux kernel=2.6.12.6

Linux Linux kernel=2.6.17.7

Linux Linux kernel=2.6.11.7

Linux Linux kernel=2.6.15

Linux Linux kernel=2.6.15-rc1

Linux Linux kernel=2.6.14.2

Linux Linux kernel=2.6.14-rc4

Linux Linux kernel=2.6.18

Linux Linux kernel=2.6.0-test7

Linux Linux kernel=2.6.17.6

Linux Linux kernel=2.6.16.7

Linux Linux kernel=2.6.17.13

Linux Linux kernel=2.6.8-rc2

Linux Linux kernel=2.6.8-rc3

Linux Linux kernel=2.6.11.4

Linux Linux kernel=2.6.16.19

Linux Linux kernel=2.6.11.12

Linux Linux kernel=2.6.15.5

Linux Linux kernel=2.6.0-test8

Linux Linux kernel=2.6.13.1

Linux Linux kernel=2.6.17-rc5

Linux Linux kernel=2.6.6

Linux Linux kernel=2.6.0-test3

Linux Linux kernel=2.6.12

Remediation

Patch Available

http://secunia.com/advisories/22702

Event History

Nov 6, 2006

CVE Published

08:07 PM

Data Sourced

via NVD·08:07 PM

RemedyDescriptionSeverityWeaknessAffected Software

Nov 7, 2006

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-5757?

CVE-2006-5757 is classified as a medium severity vulnerability due to its potential to cause a denial of service.

How do I fix CVE-2006-5757?

To fix CVE-2006-5757, update the Linux kernel to a patched version that resolves the race condition in the ISO9660 filesystem.

What systems are affected by CVE-2006-5757?

CVE-2006-5757 affects various versions of the Linux kernel including 2.6.5 to 2.6.18 and possibly others.

What type of vulnerability is CVE-2006-5757?

CVE-2006-5757 is a race condition vulnerability that can lead to a denial of service when mounting crafted ISO9660 filesystems.

Who can exploit CVE-2006-5757?

Local users can exploit CVE-2006-5757 by mounting specially crafted ISO9660 filesystems with malformed data structures.