Description
The execve system call in Linux 2.4.x records the file descriptor of the executable process in the file table of the calling process, which allows local users to gain read access to restricted file descriptors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | kernel-image-2.4.17-ia64 | kernel-image-2.4.17-ia64 | DSA-423 |
| Debian 3.0 | kernel-image-2.4.18-1-alpha | 2.4.18-8 | DSA-358-1 |
| Debian 3.0 | kernel-image-2.4.18-1-i386 | 2.4.18-9 | DSA-358-1 |
| Debian 3.0 | kernel-image-2.4.18-i386bf | 2.4.18-5woody2 | DSA-358-1 |
| Debian 3.0 | kernel-source-2.4.18 | 2.4.18-11 | DSA-358-1 |
Advisories 2
- DSA-423 linux-kernel-2.4.17-ia64 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-358-1 linux-kernel-2.4.18 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- oval:org.mitre.oval:def:327 vdb-entry signature
- 20030626 Linux 2.4.x execve() file read race vulnerability mailing-list
- RHSA-2003:238 vendor-advisory
- DSA-423 vendor-advisory
- MDKSA-2003:074 vendor-advisory
- RHSA-2003:408 vendor-advisory
- DSA-358 vendor-advisory
- RHSA-2003:368 vendor-advisory