Description
The mremap system call (do_mremap) in Linux kernel 2.4.x before 2.4.21, and possibly other versions before 2.4.24, does not properly perform bounds checks, which allows local users to cause a denial of service and possibly gain privileges by causing a remapping of a virtual memory area (VMA) to create a zero length VMA, a different vulnerability than CAN-2004-0077.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | kernel-image-2.4.16-lart +2 | 2.4.16-20040204 | DSA-439 |
| Debian 3.0 | kernel-image-2.4.17-hppa | 32.3 | DSA-470 |
| Debian 3.0 | kernel-image-2.4.17-ia64 | kernel-image-2.4.17-ia64 | DSA-423 |
| Debian 3.0 | kernel-image-2.4.17-s390 | 2.4.17-2.woody.3 | DSA-442 |
| Debian 3.0 | kernel-image-2.4.18-1-alpha | 2.4.18-12 | DSA-417 |
| Debian 3.0 | kernel-image-2.4.18-1-i386 | 2.4.18-12.1 | DSA-413 |
| Debian 3.0 | kernel-image-2.4.18-hppa | 62.1 | DSA-475 |
| Debian 3.0 | kernel-patch-2.4.16-arm | 20040204 | DSA-439 |
| Debian 3.0 | kernel-patch-2.4.17-mips | 2.4.17-0.020226.2.woody3 | DSA-427 |
| Debian 3.0 | kernel-patch-2.4.17-s390 | 0.0.20020816-0.woody.2 | DSA-442 |
| Debian 3.0 | kernel-patch-2.4.18-powerpc | 2.4.18-1woody3 | DSA-417 |
| Debian 3.0 | kernel-patch-2.4.19-mips | 2.4.19-4.woody1 | DSA-450 |
| Debian 3.0 | kernel-source-2.4.17 +1 | 2.4.17-4 | DSA-440 |
| Debian 3.0 | kernel-source-2.4.18 | 2.4.18-14.1 | DSA-413 |
| Debian 3.0 | kernel-source-2.4.19 | 2.4.19-0.020911.1.woody3 | DSA-450 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | kernel +8 | 2.4.21-4.0.2.EL | RHSA-2003:416 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 3
- Linux Kernel 2.4.23/2.6.0 - 'do_mremap()' Bound Checking Privilege Escalation EDB-145 · local · Jan 15, 2004 · verified
- Linux Kernel 2.4.23/2.6.0 - 'do_mremap()' Bound Checking Validator (2) EDB-142 · local · Jan 7, 2004 · verified
- Linux Kernel 2.4.23/2.6.0 - 'do_mremap()' Bound Checking Validator (1) EDB-141 · local · Jan 6, 2004 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 11
- RHSA-2003:416 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-427 linux-kernel-2.4.17-mips+mipsel - missing boundary check Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-470 linux-kernel-2.4.17-hppa - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-439 linux-kernel-2.4.16-arm - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-423 linux-kernel-2.4.17-ia64 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-450 linux-kernel-2.4.19-mips - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-442 linux-kernel-2.4.17-s390 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-475 linux-kernel-2.4.18-hppa - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-440 linux-kernel-2.4.17-powerpc-apus - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-417 linux-kernel-2.4.18-powerpc+alpha - missing boundary check Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-413 linux-kernel-2.4.18 - missing boundary check Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20163 third-party-advisory
- DSA-1082 vendor-advisory
- DSA-423 vendor-advisory
- RHSA-2003:417 vendor-advisory
- CLA-2004:799 vendor-advisory
- DSA-450 vendor-advisory
- DSA-1070 vendor-advisory
- DSA-440 vendor-advisory
- 20040112 SmoothWall Project Security Advisory SWP-2004:001 mailing-list
- DSA-439 vendor-advisory
- DSA-1067 vendor-advisory
- DSA-475 vendor-advisory
- DSA-1069 vendor-advisory
- ESA-20040105-001 vendor-advisory
- DSA-417 vendor-advisory
- DSA-442 vendor-advisory
- 20202 third-party-advisory
- DSA-470 vendor-advisory
- 20338 third-party-advisory
- IMNX-2004-73-001-01 vendor-advisory
- RHSA-2003:416 vendor-advisory
- linux-domremap-gain-privileges(14135) vdb-entry
- http://klecker.debian.org/~joey/security/kernel/patches/patch.CAN-2005-0528.mremap
- DSA-413 vendor-advisory
- 20040105 Linux kernel do_mremap() proof-of-concept exploit code mailing-list
- 20040107 [slackware-security] Kernel security update (SSA:2004-006-01) mailing-list
- 20040106 Linux mremap bug correction mailing-list
- 2004-0001 vendor-advisory
- oval:org.mitre.oval:def:860 vdb-entry signature
- 20040108 [slackware-security] Slackware 8.1 kernel security update (SSA:2004-008-01) mailing-list
- 3315 vdb-entry
- oval:org.mitre.oval:def:867 vdb-entry signature
- http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.24
- 9356 vdb-entry
- http://svn.debian.org/wsvn/kernel/patch-tracking/CVE-2005-0528?op=file&rev=0&sc=0
- http://isec.pl/vulnerabilities/isec-0013-mremap.txt
- 20040105 Linux kernel mremap vulnerability mailing-list
- DSA-427 vendor-advisory
- RHSA-2003:418 vendor-advisory
- O-045 third-party-advisory government-resource
- RHSA-2003:419 vendor-advisory
- SuSE-SA:2004:003 vendor-advisory
- 10532 third-party-advisory
- VU#490620 third-party-advisory
- MDKSA-2004:001 vendor-advisory