Description
The kernel module loader in Linux kernel 2.2.x before 2.2.25, and 2.4.x before 2.4.21, allows local users to gain root privileges by using ptrace to attach to a child process that is spawned by the kernel.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | kernel-image-2.2.20-i386 | 2.2.20-5woody3 | DSA-336 |
| Debian 3.0 | kernel-image-2.4.17-ia64 | kernel-image-2.4.17-ia64 | DSA-423 |
| Debian 3.0 | kernel-image-2.4.17-s390 | 2.4.17-2.woody.2.2 | DSA-276 |
| Debian 3.0 | kernel-image-2.4.18-1-i386 | 2.4.18-8 | DSA-311 |
| Debian 3.0 | kernel-image-2.4.18-i386bf | 2.4.18-5woody1. | DSA-311 |
| Debian 3.0 | kernel-patch-2.4.16-arm +3 | 20040419 | DSA-495 |
| Debian 3.0 | kernel-patch-2.4.17-mips | 2.4.17-0.020226.2.woody1 | DSA-332, DSA-270 |
| Debian 3.0 | kernel-patch-2.4.17-s390 | 0.0.20020816-0.woody.1.1 | DSA-276 |
| Debian 3.0 | kernel-patch-2.4.18-powerpc | 2.4.18-1woody1 | DSA-312 |
| Debian 3.0 | kernel-patch-2.4.19-mips | 2.4.19-0.020911.1.woody1 | DSA-270 |
| Debian 3.0 | kernel-source-2.2.20 | 2.2.20-5woody2 | DSA-336 |
| Debian 3.0 | kernel-source-2.4.16 | 2.4.16-1woody2 | DSA-495 |
| Debian 3.0 | kernel-source-2.4.17 | 2.4.17-1woody1 | DSA-332 |
| Debian 3.0 | kernel-source-2.4.18 | 2.4.18-9 | DSA-311 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 4
- Linux Kernel < 2.4.20 - Module Loader Privilege Escalation EDB-12 · local · Apr 14, 2003 · verified
- Linux Kernel 2.2.x/2.4.x - Privileged Process Hijacking Privilege Escalation (2) EDB-22363 · local · Apr 10, 2003 · verified
- Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation EDB-3 · local · Mar 30, 2003 · verified
- Linux Kernel 2.2.x/2.4.x - Privileged Process Hijacking Privilege Escalation (1) EDB-22362 · local · Mar 17, 2003 · verified
GitHub 1 repository
-
anilkashyap01/Binary-Exploitation-and-Kernel-Escalation ★ 1 · Apr 15, 2026
Secured root-level access by identifying and exploiting misconfigurations and outdated software. Buffer overflow vulnerability in an outdated version of mod_ssl (CVE-2002-0082). Privilege escalation …
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 8
- DSA-423 linux-kernel-2.4.17-ia64 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-495 linux-kernel-2.4.16-arm - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-311 linux-kernel-2.4.18 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-336 linux-kernel-2.2.20 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-332 linux-kernel-2.4.17 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-312 kernel-patch-2.4.18-powerpc - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-276 linux-kernel-s390 - local privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-270 linux-kernel-mips - local privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2003:103 vendor-advisory
- RHSA-2003:088 vendor-advisory
- DSA-270 vendor-advisory
- DSA-423 vendor-advisory
- RHSA-2003:098 vendor-advisory
- DSA-336 vendor-advisory
- DSA-276 vendor-advisory
- ESA-20030515-017 vendor-advisory
- MDKSA-2003:039 vendor-advisory
- DSA-495 vendor-advisory
- GLSA-200303-17 vendor-advisory
- DSA-311 vendor-advisory
- DSA-332 vendor-advisory
- 20030317 Fwd: Ptrace hole / Linux 2.2.25 mailing-list
- oval:org.mitre.oval:def:254 vdb-entry signature
- RHSA-2003:145 vendor-advisory
- MDKSA-2003:038 vendor-advisory
- DSA-312 vendor-advisory
- VU#628849 third-party-advisory